Account System Attack Guide

G5 Cyber Security

2 weeks ago

TL;DR

Beyond passwords, account systems are vulnerable to many attacks. This guide covers common threats like brute-force, credential stuffing, session hijacking, and more. We’ll look at how they work and what you can do to protect yourself.

Account System Attack Guide

Brute-Force Attacks
- What it is: Trying many usernames and passwords until one works. Often automated.
- How it works: Attackers use lists of common passwords or generate combinations. They might target a single account or many at once.
- Protection:
  - Strong Passwords: Enforce minimum length and complexity requirements (uppercase, lowercase, numbers, symbols).
  - Account Lockout: Temporarily disable accounts after several failed login attempts. Example configuration in /etc/ssh/sshd_config:
```
MaxAuthTries 3
LockoutTime 60
```
  - Rate Limiting: Limit the number of login attempts from a single IP address within a specific timeframe.
  - CAPTCHAs: Use CAPTCHAs to distinguish humans from bots.
Credential Stuffing Attacks
- What it is: Using stolen usernames and passwords (from other breaches) on your system.
- How it works: Attackers obtain lists of credentials from data breaches and try them on various websites, hoping users reuse the same login details.
- Protection:
  - Password Breach Monitoring: Check if user passwords appear in known breach databases (e.g., using Have I Been Pwned API).
  - Two-Factor Authentication (2FA): Requires a second verification method, making stolen credentials less useful.
  - Educate Users: Encourage unique passwords for each service.
Session Hijacking Attacks
- What it is: Stealing a user’s active session to gain unauthorised access.
- How it works: Attackers can use techniques like cross-site scripting (XSS) or man-in-the-middle attacks to obtain the session cookie.
- Protection:
  - HTTPS: Use HTTPS to encrypt all communication, preventing eavesdropping.
  - Secure Cookies: Set the HttpOnly and Secure flags on cookies. Example in PHP:
```
setcookie("session_id", $session_id, ["secure" => true, "httponly" => true]);
```
  - Session Timeout: Automatically log users out after a period of inactivity.
  - Regular Session Regeneration: Change the session ID periodically to limit the impact of stolen cookies.
Cross-Site Request Forgery (CSRF) Attacks
- What it is: Tricking a logged-in user into performing unwanted actions on your website.
- How it works: Attackers create malicious web pages that submit requests to your site on behalf of the user.
- Protection:
  - CSRF Tokens: Include unique, unpredictable tokens in forms and verify them on submission. Example (simplified) using a random string:
```
$csrf_token = bin2hex(random_bytes(32));
$_SESSION['csrf_token'] = $csrf_token;
// In the form:
<input type="hidden" name="csrf_token" value="{$csrf_token}"//>
```
  - SameSite Cookie Attribute: Set the SameSite attribute to ‘Strict’ or ‘Lax’ to prevent cross-site requests.
Account Enumeration Attacks
- What it is: Discovering valid usernames on your system.
- How it works: Attackers try different usernames during login or password reset processes to identify existing accounts.
- Protection:
  - Generic Error Messages: Avoid revealing whether a username exists. Return the same error message for invalid and valid usernames.
  - Rate Limiting: Limit attempts to check username validity.
Phishing Attacks (Targeting Accounts)
- What it is: Deceiving users into revealing their credentials through fake websites or emails.
- How it works: Attackers create convincing replicas of your login page and send links to unsuspecting users.
- Protection:
  - Educate Users: Teach them how to identify phishing attempts (check URLs, sender addresses, grammar).
  - Email Authentication: Implement SPF, DKIM, and DMARC to verify email sources.
  - Multi-Factor Authentication: Even if credentials are stolen through phishing, 2FA can prevent access.