Skip to main content

Cracked weak credentials

Need​

Enhancement of password security

Context​

  • Usage of C# 7.1 for advanced language features and improvements
  • Usage of _userManager for user management and authentication
  • Usage of _signInManager for managing user sign-in functionality
  • Usage of LoginViewModel for managing login functionality in a view
  • Usage of Controller for organizing and handling logic in a Node.js application
  • Usage of IActionResult for defining and returning action results in a web application
  • Usage of Task for managing asynchronous operations and scheduling tasks
  • Usage of RedirectToActionResult for redirecting to a specific action or controller in a web application
  • Usage of ViewResult for rendering views in a web application

Description​

Non compliant code​

public class AccountController : Controller
{
    [HttpPost]
    public async Task<IActionResult> Login(LoginViewModel model)
    {
        if (ModelState.IsValid)
        {
            var user = await _userManager.FindByNameAsync(model.Username);
            if (user != null)
            {
                var result = await _signInManager.PasswordSignInAsync(user, model.Password, model.RememberMe, lockoutOnFailure: false);
                if (result.Succeeded)
                {
                    return RedirectToAction("Index", "Home");
                }
            }
        }

        ModelState.AddModelError("", "Invalid login attempt.");
        return View(model);
    }
}

This piece of code is an ASP.NET Core controller action method that handles user login. It first checks if the incoming model state is valid, then it attempts to find the user by the provided username using the _userManager object.

If the user is found, it will then attempt to sign in the user using the _signInManager object by passing the user object, the password provided in the model, a boolean indicating if the user should be remembered, and a flag indicating if the account should be locked out on failure.

The problem is that the password is stored in the database in a low complexity hash format. This means that if an attacker manages to get hold of the password hashes, they could easily crack them due to their low complexity.

ASP.NET Core uses PBKDF2 (Password-Based Key Derivation Function 2) with HMAC-SHA256, 128-bit salt, 256-bit subkey, and 10,000 iterations by default. If the password hashing mechanism is not properly configured, it may create a vulnerability where the password hashes can be easily cracked.

This vulnerability can be exploited if an attacker is able to gain access to the database either through SQL Injection or by gaining access to the database files or backups. Once they have the password hashes, they can then use brute force or dictionary attacks to crack them.

This is a serious security issue because once an attacker has a user's password, they can impersonate that user and perform actions on their behalf, potentially leading to unauthorized access to sensitive data or functionality.

Steps​

  • Use a strong password hashing algorithm, such as bcrypt or Argon2, to securely store user passwords in the database.
  • Implement password complexity requirements to ensure that users choose strong passwords.
  • Enforce a minimum password length and require a combination of uppercase and lowercase letters, numbers, and special characters.
  • Implement account lockout mechanisms to prevent brute-force attacks.
  • Consider implementing multi-factor authentication to add an extra layer of security.
  • Regularly update and patch the application and its dependencies to protect against known vulnerabilities.
  • Educate users about the importance of using strong passwords and regularly updating them.

Compliant code​

public class AccountController : Controller
{
    private readonly UserManager<IdentityUser> _userManager;
    private readonly SignInManager<IdentityUser> _signInManager;

    public AccountController(UserManager<IdentityUser> userManager, SignInManager<IdentityUser> signInManager)
    {
        _userManager = userManager;
        _signInManager = signInManager;
    }

    [HttpPost]
    public async Task<IActionResult> Login(LoginViewModel model)
    {
        if (ModelState.IsValid)
        {
            var user = await _userManager.FindByNameAsync(model.Username);
            if (user != null)
            {
                var result = await _signInManager.PasswordSignInAsync(user, model.Password, model.RememberMe, lockoutOnFailure: true);
                if (result.Succeeded)
                {
                    return RedirectToAction("Index", "Home");
                }
            }
        }

        ModelState.AddModelError("", "Invalid login attempt.");
        return View(model);
    }
}

The updated code now uses the built-in UserManager and SignInManager classes provided by ASP.NET Core Identity. These classes handle user management and authentication, including password hashing and validation.

The PasswordSignInAsync method now has the lockoutOnFailure parameter set to true. This means that if a user repeatedly enters an incorrect password, their account will be locked for a period of time. This helps to prevent brute-force attacks.

In addition, the UserManager class uses a secure password hashing algorithm by default. This means that even if an attacker gains access to the database, they will not be able to easily crack the hashed passwords.

To further enhance security, you should also implement password complexity requirements. This can be done by configuring the Password options in the IdentityOptions class in the Startup.cs file. For example, you can require a minimum password length and a combination of uppercase and lowercase letters, numbers, and special characters.

Finally, consider implementing multi-factor authentication to add an extra layer of security. This can be done using the built-in TwoFactorSignInAsync method provided by the SignInManager class.

References​

Last updated on