Account System Attack Guide

TL;DR

Beyond passwords, account systems are vulnerable to many attacks. This guide covers common threats like brute-force, credential stuffing, session hijacking, and more. We’ll look at how they work and what you can do to protect yourself.

Account System Attack Guide

1. Brute-Force Attacks
   • What it is: Trying many usernames and passwords until one works. Often automated.
   • How it works: Attackers use lists of common passwords or generate combinations. They might target a single account or many at once.
   • Protection:
     • Strong Passwords: Enforce minimum length and complexity requirements (uppercase, lowercase, numbers, symbols).
     • Account Lockout: Temporarily disable accounts after several failed login attempts. Example configuration in /etc/ssh/sshd_config:

       MaxAuthTries 3
       LockoutTime 60
       

     • Rate Limiting: Limit the number of login attempts from a single IP address within a specific timeframe.
     • CAPTCHAs: Use CAPTCHAs to distinguish humans from bots.
2. Credential Stuffing Attacks
   • What it is: Using stolen usernames and passwords (from other breaches) on your system.
   • How it works: Attackers obtain lists of credentials from data breaches and try them on various websites, hoping users reuse the same login details.
   • Protection:
     • Password Breach Monitoring: Check if user passwords appear in known breach databases (e.g., using Have I Been Pwned API).
     • Two-Factor Authentication (2FA): Requires a second verification method, making stolen credentials less useful.
     • Educate Users: Encourage unique passwords for each service.
   • Session Hijacking Attacks
     • What it is: Stealing a user’s active session to gain unauthorised access.
     • How it works: Attackers can use techniques like cross-site scripting (XSS) or man-in-the-middle attacks to obtain the session cookie.
     • Protection:
       • HTTPS: Use HTTPS to encrypt all communication, preventing eavesdropping.
       • Secure Cookies: Set the HttpOnly and Secure flags on cookies. Example in PHP:

         setcookie("session_id", $session_id, ["secure" => true, "httponly" => true]);
         

       • Session Timeout: Automatically log users out after a period of inactivity.
       • Regular Session Regeneration: Change the session ID periodically to limit the impact of stolen cookies.
     • Cross-Site Request Forgery (CSRF) Attacks
       • What it is: Tricking a logged-in user into performing unwanted actions on your website.
       • How it works: Attackers create malicious web pages that submit requests to your site on behalf of the user.
       • Protection:
         • CSRF Tokens: Include unique, unpredictable tokens in forms and verify them on submission. Example (simplified) using a random string:

           $csrf_token = bin2hex(random_bytes(32));
           $_SESSION['csrf_token'] = $csrf_token;
           // In the form:
           <input type="hidden" name="csrf_token" value="{$csrf_token}"//>
           

         • SameSite Cookie Attribute: Set the SameSite attribute to ‘Strict’ or ‘Lax’ to prevent cross-site requests.
       • Account Enumeration Attacks
         • What it is: Discovering valid usernames on your system.
         • How it works: Attackers try different usernames during login or password reset processes to identify existing accounts.
         • Protection:
           • Generic Error Messages: Avoid revealing whether a username exists. Return the same error message for invalid and valid usernames.
           • Rate Limiting: Limit attempts to check username validity.
         • Phishing Attacks (Targeting Accounts)
           • What it is: Deceiving users into revealing their credentials through fake websites or emails.
           • How it works: Attackers create convincing replicas of your login page and send links to unsuspecting users.
           • Protection:
             • Educate Users: Teach them how to identify phishing attempts (check URLs, sender addresses, grammar).
             • Email Authentication: Implement SPF, DKIM, and DMARC to verify email sources.
             • Multi-Factor Authentication: Even if credentials are stolen through phishing, 2FA can prevent access.