Skip to main content

Account Takeover

Need​

Enhanced authentication and authorization mechanisms to prevent unauthorized access and account takeover

Context​

  • Usage of C# 7.1 for developing applications with advanced language features and improvements
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core
  • Usage of Microsoft.AspNetCore.Identity for managing user authentication and authorization in ASP.NET Core applications

Description​

Non compliant code​

// This is a simple representation of a user login function in an ASP.NET Core application
[HttpPost]
public async Task<IActionResult> Login(string username, string password)
{
    var user = await _userManager.FindByNameAsync(username);
    if (user == null)
    {
        return Unauthorized();
    }

    var result = await _signInManager.PasswordSignInAsync(user, password, false, false);
    if (result.Succeeded)
    {
        return Ok();
    }

    return Unauthorized();
}

This code represents a typical login function in an ASP.NET Core application using Identity for user management.

The function accepts a username and password as parameters. It then tries to find a user with the provided username using the _userManager.FindByNameAsync(username) function. If the user is not found, an Unauthorized response is returned.

Next, the function attempts to sign in the user using the provided password with the _signInManager.PasswordSignInAsync(user, password, false, false) function. If the sign-in is successful, an Ok response is returned. Otherwise, an Unauthorized response is returned.

This code is vulnerable to account takeover due to the following reasons:

  • There is no account lockout mechanism in place. This means that an attacker can perform a brute force attack by continuously trying different passwords until the correct one is found.
  • There is no multi-factor authentication (MFA) implemented. If an attacker somehow manages to get hold of a user's password, they can easily take over the account.
  • There is no rate limiting implemented. This means that an attacker can make unlimited login attempts in a short period of time, increasing the chances of a successful brute force attack.
  • The function does not log failed login attempts. This makes it harder to detect and respond to brute force attacks.

Steps​

  • Implement strong password requirements
  • Use secure password storage mechanisms (e.g., hashing and salting)
  • Implement multi-factor authentication
  • Enforce account lockout after multiple failed login attempts
  • Implement session management and expiration
  • Implement secure session handling (e.g., using secure cookies)
  • Regularly update and patch the application and its dependencies
  • Implement secure coding practices to prevent other vulnerabilities that could lead to account takeover

Compliant code​

// This is a simple representation of a user login function in an ASP.NET Core application
[HttpPost]
public async Task<IActionResult> Login(string username, string password)
{
    var user = await _userManager.FindByNameAsync(username);
    if (user == null)
    {
        return Unauthorized();
    }

    // Check if the account is locked due to many failed login attempts
    if(await _userManager.IsLockedOutAsync(user))
    {
        return StatusCode(423); // Locked
    }

    var result = await _signInManager.PasswordSignInAsync(user, password, false, false);
    if (result.Succeeded)
    {
        // Reset the count of failed logins
        await _userManager.ResetAccessFailedCountAsync(user);
        return Ok();
    }
    else
    {
        // Increase the count of failed logins
        await _userManager.AccessFailedAsync(user);
        return Unauthorized();
    }
}

The updated code now includes a mechanism to lock out a user account after multiple failed login attempts. This is done by using the IsLockedOutAsync method of the UserManager class to check if the user account is locked. If it is, the method returns a 423 (Locked) status code.

If the login attempt is successful, the ResetAccessFailedCountAsync method of the UserManager class is used to reset the count of failed login attempts for the user account.

If the login attempt fails, the AccessFailedAsync method of the UserManager class is used to increase the count of failed login attempts for the user account. After a certain number of failed attempts, the UserManager will automatically lock the user account.

This is just one part of the solution to prevent account takeover. Other measures such as implementing strong password requirements, using secure password storage mechanisms (e.g., hashing and salting), implementing multi-factor authentication, enforcing account lockout after multiple failed login attempts, implementing session management and expiration, implementing secure session handling (e.g., using secure cookies), regularly updating and patching the application and its dependencies, and implementing secure coding practices to prevent other vulnerabilities that could lead to account takeover should also be implemented.

References​

Last updated on