-: Authentication attacks.
In this lesson, we are going to talk about
authentication attacks and what you can do to prevent them.
We're going to talk about things like spoofing,
man-in-the-middle, password spraying, credential stuffing,
and broken authentication, as well as several others.
Now, when we talk about spoofing,
this is a software-based attack
where the goal is to assume the identity
of a user, a process, an address,
or other unique identifier.
Spoofing is used a lot to try to bypass authentication
and be able to present yourself as if you're somebody else.
Now, one of the things attackers love to try
is the man-in-the-middle attack.
Now, a man-in-the-middle attack, or MitM,
is an attack where the attacker
is going to sit between two communicating hosts
and transparently captures, monitors,
and relays the communications between those hosts.
Now, we've talked about a man-in-the-middle before,
but essentially, if you're on a wireless network,
somebody could be sniffing the air, capturing those packets,
and then being a man-in-the-middle.
They can capture what's being said.
Now, they put themselves
directly in the middle of the communication,
you might be connecting to them,
and they would be connecting to the server
and they're listening to everything you say.
They can capture it, monitor it, and relay it right on,
or they could even modify it if they wanted to.
Now, a variation on this
is what's known as a man-in-the-browser.
This is an MitB.
This is an attack that intercepts the API calls
between the browser process and its DLLs.
And so, if you're attacking the network
or between two clients or a client in the server,
you're a man-in-the-middle.
If you're using the browser to do it,
you're a man-in-the-browser.
Now, one of the things that people love to try to do
is break passwords because if they can get your password,
they can own your system, right?
Well, let's talk about the way passwords work, for a moment.
This will be a quick review from Security+.
Now, when you take a password and you go to store it,
do you store in the database as the word password?
No, you actually hash it first.
So, it's going to be an MD5 hash or a SHA1 hash
or a SHA256 hash.
And it's going to be able to be stored in that database
as that hash.
So, nobody knows what that actual password is.
Not even the system administrator, in theory.
Now, this means that that password can not be recoverable
cause you can't go from the hash back to the original.
So, when the user chooses that password,
we're going to make sure we hash it
using that cryptographic function
anytime we store it to our database.
This will help protect our users
inside of our web applications.
Now, even though we do that,
a lot of people are still going to try to guess your password.
Now, there's a lot of different ways
that they try to do this.
And one of the most common is what's known as
an online password attack.
This involves somebody simply trying to guess
what your password is
and entering it directly to the service.
Think about this way,
I want to log in to Facebook as if I was you.
I know your username because it's tied to your email.
So, I type in your email address
and I start typing in passwords and try hitting login.
Each time I do that, I'm doing an online password attack.
I'm guessing passwords over and over and over again
until I get in.
Now, this is the idea of how you can do
an online password attack.
Now, how can you, as an analyst,
identify that that's what's going on?
Well, you can look at the logs.
If you look at your audit logs,
you should see something that looks like this.
Here, somebody was trying to log in as Jason,
they tried at 19:12 and they tried using the word p@$$w0rd.
And then, they tried 19:13 using p@$$1234.
Then, they tried 19:14, puppy123, 19:15, cupcake@#, 19:16, admin,
19:17, admin123.
And so, this is an example
of when you see somebody trying to do
an online password attack.
They're basically going in
and logging in as if they were you, just like you would,
except they're using the wrong password
cause they don't know yours yet.
This can be useful if you know the person
and if you're an attacker
who has some knowledge about that person
and can try to get something that they might be thinking.
But, otherwise, it's a pretty inefficient way of doing it.
Now, to prevent this type of an attack from happening,
there's really a couple of things you can do.
You can restrict the number or the rate of login attempts
to prevent these online password attacks.
So, you can lock the account after three incorrect attempts
where they have to reset their password or contact security.
That will be one way to do it.
Or you could say, you can only log in three times.
If you get it wrong, you have to wait 20 minutes
and then it would reset again.
That's limiting the rate of it.
And so, these are different ways that you can do this.
Now, another way that people would try to break
into your password is by doing password spraying.
This is a brute force type of attack
in which multiple user accounts are tested
with a dictionary of common passwords.
So, here's an example of this going from 19:12 to 19:17 again.
Notice the first two attempts were against Jason.
They tried p@$$w0rd and p@$$123.
The second two attempts were against Tim
using, again, p@$$w0rd and p@$$123.
The third attempt was against Tamera, p@$$w0rd and p@$$123.
Notice the difference here.
We have groupings of the same passwords
that are common words from a dictionary
being tried over and over again against different accounts.
This makes it password spraying
instead of an online password attack.
Now, the last one we're going to talk about here
is credential stuffing.
Now, credential stuffing
is another type of brute-force attack.
In this one,
they're going to try and take stolen user account names
and passwords and test them against multiple websites.
So, let's say there was a new story
and there was a new data breach that happened
and Facebook got hacked.
And now, all of Facebook's usernames and passwords are known.
So, everybody knows what the usernames are, which are emails
and the passwords.
Now, Facebook is going to make everybody go in
and change their passwords, right?
So, you're not going to be able to get back into Facebook,
but they could take that user and password
and try it on Gmail or Yahoo or MSN or some other website.
And by going across to different websites,
you can try doing this credential stuff because you know,
it was a valid username and password on one system,
it may be on others
because people tend to reuse their usernames and passwords.
So, how do you prevent credential stuffing?
Well, credential stuffing can be prevented
by not reusing passwords across these different websites.
Now, the next thing we want to talk about
is broken authentication.
Broken authentication is a software vulnerability
where the authentication mechanisms
allow the attacker to gain entry.
Essentially, the coders did a really bad job.
Now, when this happens, you can have bad things happen
like displaying clear text credentials,
using weak session tokens,
or permitting brute-force login requests.
Now, what causes these types of things?
Well, weak password credentials, for one.
Let's say you built a system
and you said, all passwords will be four digits long.
That's a pretty weak system.
There's only a thousand variations.
So, people could brute force their way in.
Another thing that would happen is if you had weak password
reset methods.
So, you're going to use something like knowledge factors
that are tied to things that people could easily look up.
What is your birthday?
Where were you born?
What state are you registered to vote in?
These are all weak things,
because most of this information is stuff
you can find online about people.
So, we wouldn't want to use those types of things.
Next, you have credential exposure.
Now, credential exposure is when the app actually exposes
the credentials or the authentication tokens
to somebody who's in the middle,
so if we have a man-in-the-middle.
Now, this is really bad because a lot of applications
will hard-code credentials into the application
or they're not using encryption.
So, they're sending things across the network in plain text,
or they're using weak encryption.
And so, because of using weak encryption, it can be cracked.
These are all things that can lead
to this credential exposure.
And then, finally, we have session hijacking.
This is when the application is vulnerable
to session hijacking
because maybe you're using session keys
that just aren't really strong
and they're really easy to guess.
And so, that's an easy way for people to guess that session,
jump into it, hijack it,
and then get the information they want.