Hacking user accounts on many websites is still easier than it could and should
be. This blog post helps you secure your application against identity theft by
going over the most common hacker attacks against authentication services and
outlining mitigations against them.
Password guessing
One of the easiest ways to steal someone's account is to try all possible
passwords until one of them works. This is called a brute-force attack. At
first, there seem to be many possible passwords one would need to try here.
However, password guessing attacks are more successful than one might assume
because many people use similar passwords. Here is a list of the
most common ones.
If your password is listed here, anybody in the world can hack your account in a
few minutes by just trying these passwords manually! More sophisticated hackers
use computer scripts to try millions of passwords per second, for example, all
words in the dictionary, possible combinations of words and numbers, and the
list keeps increasing.
You can protect your application against password guessing by making the
passwords harder to guess: longer (at least 8 characters) and with a wider
variety of symbols. Another effective mitigation is waiting some time after
encountering an incorrect password, ideally longer with each successive failed
attempt (exponential backoff). This slows automated scripts down to levels where
they can never try a large number of passwords. Finally, check your users'
passwords against databases of leaked passwords that are known to hackers, for
example haveibeenpwned.
Hackers often get access to your database and read all its contents. If you
store your users' passwords in clear text there, the hacker will know the
passwords of all your users among other important details. Avoid this by keeping
only a fingerprint (hash) of passwords in your database. When a user enters a
password during login, you create a fingerprint of that password and compare it
to the one you have on file. If the fingerprints match, the passwords must match
as well.
Choose a strong hashing algorithm like bcrypt/Argon2. Hackers can
reverse-engineer simple fingerprints using
rainbow tables. Mix the
fingerprints with a random element called
salt to prevent this.
The best passwords are complete random characters. Password managers like
1password or bitwarden help
create and store them.
Key takeaways:
- Ensure sufficient entropy in your users' passwords to make them hard to guess.
- Ensure your users don't use leaked passwords.
- Use a gradually increasing delay between unsuccessful authentication attempts
to avoid password guessing.
- Use a strong hashing algorithm with salt.
- Use a password manager to create and manage unique passwords for each service.
If all that sounds too complicated, give Ory Kratos a try because it implements
all of these best practices out of the box.
Data interception attacks
Even the best password isn't good enough if an attacker can observe the user
entering it. This can happen when bystanders watch your keyboard while you enter
your password. It is, therefore, a part of good etiquette to look away when
others enter their passwords. Your password can also be seen by others when it
is sent over via un-encrypted wireless connections like FTP or unencrypted WiFi.
Protect yourself against these attacks by always using encrypted network
connections like SSL, SFTP, and HTTPS, instead of FTP and HTTP. Make sure to use
modern versions since some older SSL versions are not secure anymore.
Key takeaways:
Spyware
An encrypted connection doesn't help if the computer through which the user
enters the password contains hidden spyware that sends all entered text, the
screen content, or your website cookies to the hacker. Hackers can efficiently
scan large amounts of captured keystrokes for text that looks like passwords,
credit card numbers, social security numbers, and other valuable data. Stolen
cookies allow an attacker to make requests look like they're coming from you.
Secure yourself against malware by installing all software updates, using a
modern web browser, avoiding shady websites and software, and running anti-virus
software. You can reduce cookie leaks by making the lifetime of cookies short.
That's why Ory Kratos limits the lifetime of cookies to one hour.
With two-factor authentication, a user enters their username and password to
authenticate, and then they are required to provide another aspect to identify
themselves. This second aspect could be a time-based one-time-password or a code
sent via text message to your phone, although the latter is
less secure.
Two-factor authentication helps against stolen passwords and spyware since the
second factor is always different.
Takeaways:
- Bind a cookie to a user's IP address.
- Use a short cookie lifetime.
- Always install all software updates.
- Use anti-virus software.
- Use a modern web browser.
- Enable two-factor authentication.
- Use CSRF tokens on authentication forms to avoid "Connect" request
interception.
- Consider using WebAuthn for passwordless flows in
browser.
Social engineering and phishing attacks
The weakest link in your security architecture are the human users. The best
passwords aren't secure if people are tricked into revealing them to an attacker
as part of social engineering. You find many examples of social engineering in
the movie Takedown. Here is an example
that combines social engineering with a
man-in-the-middle attack:
George uses Gmail with 2-factor-authentication. Andrew wants to read George's
emails but doesn't have the password. To get it, Andrew creates a website that
looks exactly like Gmail's login screen, with a URL that sounds very close to
it, like gmoil.com. Sophisticated hackers can also use a
DNS poison attack
to make their fake website appear as gmail.com. To make George use this fake
website, Andrew sends him a fake advertisement claiming that George won a free
Gmail upgrade and just needs to log in to activate it. When George clicks on the
link in the fake ad, he ends up at Andrew's fake login page and enters his Gmail
username and password. Andrew sees the credentials and enters them into the real
Gmail website. George then enters the code received on his phone into Andrews
fake website, which Andrew also enters into the real Gmail. Andrew is now logged
into George's email. The fake website shows an error message and tells George
that there was an error and he should try again, then redirects him to the real
Gmail website. George logs in again and everything works this time. George
doesn't think much of it and goes on with his day.
