«slow down online guessing attack with device cookies», Антон Дедов (odin)
TRANSCRIPT
SlowDownOnlineGuessingAttackswithDeviceCookies
AntonDedovOWASPRussiaMeetup#6,2017
Intro:Onlineguessingattacks
App
App App
App
AppApp
App
App
App
App
App
App
App
App
App
Attackergoals
PasswordforspecificaccountPasswordforanyaccountinasystemPasswordforanyaccountinanysystem
Threats forAuthentication
Online attacksOfflineattacksPasswordleaks
App
user : password1
Onlineguessingattacks
user : password2user : password3
...
Authenticationattacks:Mitigations
M-FA/M-Step UX!Passwordpolicy Magic106
Ratelimiting ßßßßßßß
Authentication parameters e.g.time,location,etc.
Monitoring e.g.haveibeenpwned.com
©CormacHerley etal.AnAdministrator’sGuidetoInternetPasswordResearch
Ratelimiting
CAPTCHAAccountlockoutExponential timeoutsProofof work
Accountlockout:simplemath
5 attempts⇒ 20min.lockout131400 attempts/year
Accountlockout
Lockaccount EffectiveEasyDoS
Lock (account,IP) Somewhat DoSmitigationBotnetsProxiesIPv6DoSasacollateraldamage
DeviceCookieDistinguishknownclientsfromunknownones
App
Lockoutallunknowndevicesatonce
Lockoutindividualuserperdevicecookie
user : password
user : passwordDevice Cookie
Set-Cookie:KnownDevice=
LOGIN|NONCE|HMAC(secret-key,LOGIN|NONCE)
Set-Cookie:KnownDevice=JWT
{"alg": "HS256","typ": "JWT”
} . {"aud": "device-cookie","sub": "[email protected]","jti": "40e2a97a2ab37406”
}
Threats&Mitigations
Threat MitigationOnlineattackagainstoneuser PasswordpolicyOnlineattackusingstolendevicecookies Limited,preventcookieleaks
Onlineattackagainstmultipleusers NotmitigatedSpoofdevicecookie CryptoTamperwithexistingdevicecookie CryptoDoSforspecificaccount OOBdevicecookieissueDoSforspecificaccountwhenclientisusedbydifferentaccounts
Devicecookiesperaccount
Implementationrecommendations
Usegoodcrypto,likeHMAC-SHA2orsignedJWT.PreventcookieleakagewithSecure&HttpOnly flags.Issuecookieforvalidresetpasswordlink.Issuenewdevicecookieaftereachsuccessfullogin.IncludeuserIDintocookiename(privacyconcerns?).
References
OWASP:SlowDownOnlineGuessingAttackswithDeviceCookiesPasswordsCon,andspecifictalksfromPasswordsCon 14:• MarcHausetalkOnlinePasswordAttacks• AlecMuffettalkFacebookPasswordHashigh&Authentication
AnAdministrator’sGuidetoInternetPasswordResearch