Skip to main content

Insecure authentication method - NTLM

Need​

Implementation of a secure authentication method

Context​

  • Usage of Python 3 for developing applications and scripts
  • Usage of Django for building web applications in Python

Description​

Non compliant code​

from django.contrib.auth import authenticate

def login(request):
    username = request.POST['username']
    password = request.POST['password']
    user = authenticate(request, username=username, password=password)
    if user is not None:
        login(request, user)
        # Redirect to a success page.
        return HttpResponseRedirect('/success/')
    else:
        # Return an 'invalid login' error message.
        return HttpResponseRedirect('/invalid/')

This code snippet is a simple Django view for handling user login. It uses the authenticate function from Django's auth module to authenticate users based on their username and password. If the authentication is successful, the user is logged in and redirected to a success page. If the authentication fails, the user is redirected to an 'invalid login' page.

The vulnerability here lies in the use of insecure authentication method - NTLM (NT LAN Manager). NTLM is a challenge-response authentication protocol that is used to authenticate a user. However, it has several known security flaws.

  1. Relay attacks: In a relay attack, an attacker intercepts the authentication process and relays credentials from the client to the server. The attacker can then impersonate the client on the server.

  2. Man in the Middle (MitM) attacks: In a MitM attack, an attacker places themselves between the client and the server, intercepting communications between them. The attacker can then eavesdrop on, and even alter, communications between the client and the server.

  3. Brute force attacks: In a brute force attack, an attacker systematically tries all possible passwords until they find the correct one. NTLM is particularly vulnerable to this type of attack due to its use of weak encryption.

In the context of this Django application, using NTLM for authentication means that user credentials and sessions can potentially be compromised, leading to unauthorized access and potential data breaches.

Steps​

  • Replace NTLM authentication with a more secure method such as Kerberos, OAuth, or SAML.
  • Implement multi-factor authentication to add an additional layer of security.
  • Use HTTPS for all connections to prevent Man in the Middle attacks.
  • Store passwords in a hashed or encrypted format, not in plain text.
  • Implement account lockout policies to prevent brute force attacks.
  • Regularly update and patch your authentication system to protect against known vulnerabilities.

Compliant code​

from django.contrib.auth import authenticate
from django.contrib.auth.decorators import login_required
from django.views.decorators.csrf import csrf_protect
from django.contrib.auth.hashers import make_password
from django.contrib.auth import update_session_auth_hash

@csrf_protect
def login(request):
    username = request.POST['username']
    password = make_password(request.POST['password'])
    user = authenticate(request, username=username, password=password)
    if user is not None:
        login(request, user)
        # Redirect to a success page.
        return HttpResponseRedirect('/success/')
    else:
        # Return an 'invalid login' error message.
        return HttpResponseRedirect('/invalid/')

@login_required
def change_password(request):
    if request.method == 'POST':
        form = PasswordChangeForm(user=request.user, data=request.POST)
        if form.is_valid():
            form.save()
            update_session_auth_hash(request, form.user)
            return HttpResponseRedirect('/success/')
    else:
        form = PasswordChangeForm(user=request.user)
    return render(request, 'change_password.html', {'form': form})

The updated code now includes several security enhancements to address the identified vulnerabilities:

  1. Secure Authentication Method: The insecure NTLM authentication method has been replaced with Django's built-in authentication system, which is more secure.

  2. Password Hashing: The make_password function from Django's auth.hashers module is used to store passwords in a hashed format, not in plain text.

  3. CSRF Protection: The @csrf_protect decorator is used to add cross-site request forgery protection to the login view.

  4. Login Required: The @login_required decorator is used to ensure that the password change view can only be accessed by authenticated users.

  5. Password Change Form: Django's built-in PasswordChangeForm is used to handle password changes securely. This form requires the user's old password, which helps to verify the user's identity, and it also validates the new password to ensure it meets certain security requirements.

  6. Session Update: The update_session_auth_hash function is used to update the user's session hash after changing the password, which prevents the session from being invalidated.

Please note that this code does not include multi-factor authentication, HTTPS enforcement, account lockout policies, or regular updates and patches. These features should be implemented at the infrastructure level or using additional Django packages.

References​

Last updated on