secure test has found more than the H?half of the bigs online-H?ndlern in the United K?Kingdom, a user registration page anf for attacks?llig are. The password function?a forgotten, often protected as part of the registration in the most?products used in web sites, with a brute force attack or Z?be subjected to cooling. Enumeration is the process of looking for differences in response to a request by presenting valid and invalid user account names. be inserted in an e-commerce site, account user name or registered e-mail address correctly and incorrectly, see page password?forgetting to check the differences. If a valid user name, the application will respond indicating that a password?be sent to the user via e-mail. If an invalid username, can answer the request instead of "Invalid account name ". With this information, a script written to try numerous account names, are the use of these differences in the reaction. Although this is a slow process, over time a list of valid accounts are compiled k?. Can Armed with a list of valid account username, the attacker the same brute force technique that attack to crack the application and password?how the accounts. Both the username and password?a can be used to successfully log into user accounts so that Hacker to Eink?to make ufe or extract sensitive information such as addresses and credit card information.
Some H?Dealer have launched a "Lockout "User accounts after a certain number of attempts your password?not in trying to block this threat. W?While this may seem a good idea, unfortunately, ridiculed?sst the store open for other forms of abuse. There is a risk that the attacker, the accounts with the bomber valid password so bad, so the blocking of the retail customers. In fact, this creates a Denial of Service (DoS) and the application blocked gutgl?creditor users through its own aggressive lock on politics. "We test web applications t?possible notice and time again that enumeration is m?possible. There is nothing more difficult than access to user accounts, particularly if credit card users stored within, and the potential costs for the H?Dealer in terms of loss of consumer confidence k?nnten be catastrophic. "Said Ken Munro, head of the secure test. "It is alarming that this problem not restricted?nkt is on retail. Most websites with a password reminder function?are anf?llig to attack Enumeration "-. SecureTEST research suggests that Retail?dealers and other affected Web site operators must apply with their application developers and ask them one or more of the following precaution?were considered: building a "Time OutAfter login form. After three failed attempts to lock the account for a few seconds. This will slow down brute-force attack so severe that make it ineffective.
- No implementation of a permanent lock-in registration form. Otherwise, k?nnte an attacker valid user deliberately tries to block poor passwords?words?as its generic accounts. - Make sure that the error message in the application form;do not distinguish between a valid / invalid valid user name and / or password?not valid. "Entered incorrect credentials "is an appropriate response. - Consider a second factor authentication password function?to forget, for example, a memorable date, or require the input of user account name and email address registered. -?Change the message on a password form?such things as forgotten "If you entered a valid e-mail password?sent soon. If an e-mail within the N?XXX next few minutes will receive will probably be your email address misspelled, or do not have access to this application. Try again, make sure you type it correctly. This does not cause a different response for valid / invalid account name so that the list is not m?possible. - Make sure password, logging of HTTP POST requests from the login form and function?to forget k?can not by default??enabled ig -. Check your documentation for a large?e number of attacks on private accounts and corresponding Ma?take measures if it is located.
|
You are here: hacking technology
> crack analyzes
> Content
Category: Home
> crack analyzes