Blog | G5 Cyber Security

Basic Authentication Attack: Stop It Now

G5 Cyber Security

TL;DR

Basic authentication sends your username and password in plain text. An attacker can intercept this data, giving them access to your account. Disable Basic authentication wherever possible and use stronger methods like OAuth or multi-factor authentication.

What is Basic Authentication?

Basic authentication is a simple way for web browsers to send login details (username and password) to a server. It’s old, easy to implement…and very insecure. When you enter your credentials on a website using basic auth, the browser encodes them into a string of characters (Base64), but doesn’t encrypt them. This encoded string is then sent with every request.

How an Attacker Exploits Basic Authentication

  1. Man-in-the-Middle Attack: An attacker positions themselves between you and the server (e.g., on a public Wi-Fi network).
  2. Intercepting Credentials: They capture the HTTP request containing your Base64 encoded username and password.
  3. Decoding Credentials: The attacker easily decodes the Base64 string back into plain text using online tools or simple scripts.
  4. Gaining Access: With your credentials, they can log in to your account.

Here’s a simplified example of how an attacker might decode the credentials (using Python):

import base64

encoded_credentials = "dXNlcm5hbWU6cGFzc3dvcmQ=" # Example encoded string
decoded_bytes = base64.b64decode(encoded_credentials)
decoded_string = decoded_bytes.decode("utf-8")
print(decoded_string)  # Output: username:password

How to Protect Yourself (and Your Users)

  1. Disable Basic Authentication: This is the most important step! Most modern web servers and applications offer more secure alternatives.
  2. Use HTTPS: While HTTPS encrypts the entire communication, it doesn’t protect against an attacker who has compromised the server or browser. It *does* make interception harder, but isn’t a substitute for disabling Basic authentication.
  3. Implement OAuth 2.0 or OpenID Connect: These protocols allow users to log in using trusted third-party providers (like Google or Facebook) without sharing their passwords directly with your application.
  4. Use Multi-Factor Authentication (MFA): Even if an attacker intercepts a password, MFA requires a second form of verification, making it much harder for them to gain access.
  5. Consider API Keys: For machine-to-machine communication, use API keys instead of Basic authentication.

Checking if Your Site Uses Basic Authentication

You can often tell by looking at the HTTP headers in your browser’s developer tools (usually accessed by pressing F12). Look for an Authorization header containing a string that starts with Basic. If you see this, it’s using Basic authentication.

Server Configuration Examples

  1. Apache: In your Apache configuration file (e.g., httpd.conf or .htaccess), remove any directives that enable Basic authentication (like AuthType Basic and related settings).
  2. Nginx: Similarly, in your Nginx configuration file (e.g., nginx.conf), remove any blocks configuring Basic authentication.
  3. Node.js/Express: If you’re using a Node.js framework like Express and the basic-auth middleware, remove that middleware from your application code.

For example, to disable basic auth in an Nginx config file, comment out or delete these lines:

#auth_basic "Restricted Area";
#auth_basic_user_file /etc/nginx/.htpasswd;
Exit mobile version