Skip to main content

Guessed weak credentials

Need​

Enhancement of credential security

Context​

  • Requirement of Ruby 2.3 or higher for running the application
  • Usage of Rails framework for building web applications

Description​

Non compliant code​

class User < ApplicationRecord
  has_secure_password validations: false

  validates :password, presence: true
end

The above code represents a User class in a Ruby on Rails application. This class uses the built-in has_secure_password method provided by Rails, which is used to handle password hashing and comparison. The validations: false option is passed to this method, which means that Rails will not enforce any kind of password complexity or length requirements.

The validates :password, presence: true line ensures that a password must be present when a user is created or updated, but it does not enforce any other restrictions on the password.

This means that a user could potentially use a very weak password, such as "password" or "1234". This significantly reduces the amount of time required to guess the password using a brute force attack, as an attacker can quickly try common weak passwords and may gain access to the user's account.

Steps​

  • Enable password complexity requirements
  • Implement account lockout mechanism after multiple failed login attempts
  • Implement rate limiting to prevent brute force attacks
  • Consider using multi-factor authentication
  • Regularly update and rotate system credentials

Compliant code​

class User < ApplicationRecord
  has_secure_password validations: false

  validates :password, presence: true, format: { with: /\\A(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)[a-zA-Z\\d]{8,}\\z/,
    message: "must be at least 8 characters long, include at least one uppercase letter, one lowercase letter, and one digit" }

  def self.rate_limit
    # Implement rate limiting logic here
  end

  def self.lockout
    # Implement account lockout logic here
  end
end

The updated code includes a new validation for the password field. This validation ensures that the password must be at least 8 characters long, include at least one uppercase letter, one lowercase letter, and one digit. This increases the complexity of the password and makes it harder for an attacker to guess.

The rate_limit and lockout class methods are placeholders for implementing rate limiting and account lockout mechanisms. Rate limiting can help prevent brute force attacks by limiting the number of login attempts from a single IP address in a given time period. Account lockout can further secure the system by locking an account after a certain number of failed login attempts.

In addition to these code changes, consider using multi-factor authentication for an added layer of security. This could involve sending a code to the user's email or phone, which they must enter to log in.

Finally, regularly update and rotate system credentials to further reduce the risk of an attacker guessing them.

References​

Last updated on