Difference between revisions of "Storing passwords in a recoverable format"

From OWASP
Jump to: navigation, search
m
 
(4 intermediate revisions by 2 users not shown)
Line 1: Line 1:
[http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=188 levitra online] [http://news.engin.brown.edu/forums/thread-view.asp?tid=194 cheap diethylpropion] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=212 cheap propecia] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=214 cheap zanaflex] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=80 cool ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=113 cheap paxil] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=234 free sprint ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=181 free free ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=87 flexeril online] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=100 lortab online] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=237 free samsung ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=233 free sonyericsson ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=175 order cyclobenzaprine] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=119 punk ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=218 free qwest ringtones] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=349 cheap vicodin] [http://wc1.worldcrossing.com/WebX/.1de609fe free qwest ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=225 free kyocera ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=174 cyclobenzaprine online] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=186 jazz ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=171 order clomid] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=144 xanax online] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=236 free tracfone ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=180 flexeril] [http://wc1.worldcrossing.com/WebX/.1de609f3 free midi ringtones] [http://wc1.worldcrossing.com/WebX/.1de60a2c cheap ultram] [http://wc1.worldcrossing.com/WebX/.1de60a34 sony ericsson ringtones] [http://wc1.worldcrossing.com/WebX/.1de60a0d wwe ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=207 real ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=110 nokia ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=220 free punk ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=203 free funny ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=173 free cool ringtones] [http://wc1.worldcrossing.com/WebX/.1de609eb free funny ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=83 cheap didrex] [http://wc1.worldcrossing.com/WebX/.1de60a21 paxil online] [http://news.engin.brown.edu/forums/thread-view.asp?tid=172 online lorazepam] [http://wc1.worldcrossing.com/WebX/.1de60a1a free mtv ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=71 buy alprazolam] [http://news.engin.brown.edu/forums/thread-view.asp?tid=190 cheap pharmacy online] [http://wc1.worldcrossing.com/WebX/.1de60a03 free sony ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=201 free ringtones] [http://wc1.worldcrossing.com/WebX/.1de60a0b vigrx online] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=211 free polyphonic ringtones] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=358 free mp3 ringtones] [http://wc1.worldcrossing.com/WebX/.1de60a23 polyphonic ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=213 polyphonic ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=150 tramadol online] [http://news.engin.brown.edu/forums/thread-view.asp?tid=163 cheap adipex] [http://wc1.worldcrossing.com/WebX/.1de60a2b ultracet] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=219 cheap viagra] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=82 diazepam online] [http://news.engin.brown.edu/forums/thread-view.asp?tid=185 cheap zoloft] [http://news.engin.brown.edu/forums/thread-view.asp?tid=192 but vigrx] [http://wc1.worldcrossing.com/WebX/.1de60a1f cheap lisinopril] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=114 cheap pharmacy online] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=75 celexa online] [http://wc1.worldcrossing.com/WebX/.1de60a05 sprint ringtones] [http://wc1.worldcrossing.com/WebX/.1de609e4 clonazepam online] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=353 levitra] [http://wc1.worldcrossing.com/WebX/.1de60a27 but sildenafil] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=140 cheap vicodin] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=337 online xanax] [http://wc1.worldcrossing.com/WebX/.1de60a2d valium online] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=206 cheap pharmacy online] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=126 cheap sildenafil] [http://news.engin.brown.edu/forums/thread-view.asp?tid=174 cheap wellbutrin] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=160 order adipex] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=221 cheap vicodin] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=143 free wwe ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=70 free alltel ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=230 verizon ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=102 midi ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=118 buy prozac] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=189 cheap lipitor] [http://news.engin.brown.edu/forums/thread-view.asp?tid=218 sony ericsson ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=232 free sony ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=161 cheap albuterol] [http://news.engin.brown.edu/forums/thread-view.asp?tid=161 viagra online] [http://wc1.worldcrossing.com/WebX/.1de609e1 carisoprodol online] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=128 free sony ericsson ringtones] [http://wc1.worldcrossing.com/WebX/.1de60a24 cheap propecia] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=200 nexium online] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=191 lorazepam online] [http://news.engin.brown.edu/forums/thread-view.asp?tid=197 cheap flexeril] [http://wc1.worldcrossing.com/WebX/.1de60a07 free tracfone ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=182 clomid online] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=205 paxil online] [http://news.engin.brown.edu/forums/thread-view.asp?tid=208 free motorola ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=216 zyban online] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=120 free qwest ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=109 free nextel ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=79 clonazepam online] [http://news.engin.brown.edu/forums/thread-view.asp?tid=211 free music ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=226 cheap tramadol] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=333 soma online] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=81 cyclobenzaprine online] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=332 tramadol online] [http://news.engin.brown.edu/forums/thread-view.asp?tid=160 ativan online] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=68 buy adipex] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=108 nexium online] [http://news.engin.brown.edu/forums/thread-view.asp?tid=167 clonazepam online] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=90 hgh online] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=132 tenuate online] [http://wc1.worldcrossing.com/WebX/.1de60a32 zoloft] [http://news.engin.brown.edu/forums/thread-view.asp?tid=223 free midi ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=166 order alprazolam] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=72 ambien online] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=241 sony ericsson ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=184 lisinopril online] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=194 free midi ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=74 carisoprodol online] [http://wc1.worldcrossing.com/WebX/.1de609f8 nokia ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=182 free funny ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=176 didrex online] [http://news.engin.brown.edu/forums/thread-view.asp?tid=196 hgh online] [http://wc1.worldcrossing.com/WebX/.1de60a10 cheap didrex] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=129 sony ringtones] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=339 ultram online] [http://wc1.worldcrossing.com/WebX/.1de609ec buy hgh] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=85 ericsson ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=156 fioricet] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=76 online cialis] [http://wc1.worldcrossing.com/WebX/.1de60a1e order flexeril] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=336 cheap carisoprodol] [http://wc1.worldcrossing.com/WebX/.1de609ff free real ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=198 hoodia online] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=165 ambien] [http://news.engin.brown.edu/forums/thread-view.asp?tid=186 cheap lipitor] [http://wc1.worldcrossing.com/WebX/.1de609fa free online pharmacy] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=88 free free ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=146 buy zanaflex] [http://news.engin.brown.edu/forums/thread-view.asp?tid=153 phentermine online] [http://wc1.worldcrossing.com/WebX/.1de60a11 buy diethylpropion] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=240 buy soma] [http://news.engin.brown.edu/forums/thread-view.asp?tid=210 sprint ringtones] [http://wc1.worldcrossing.com/WebX/.1de609e7 diazepam online] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=125 free sharp ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=170 cheap hydrocodone] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=347 online adipex] [http://news.engin.brown.edu/forums/thread-view.asp?tid=155 buy xanax] [http://wc1.worldcrossing.com/WebX/.1de609e3 clomid online] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=356 free tracfone ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=222 free sharp ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=98 lisinopril] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=223 wellbutrin online] [http://wc1.worldcrossing.com/WebX/.1de60a15 kyocera ringtones] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=362 free motorola ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=115 phentermine online] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=215 buy zoloft] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=167 cheap carisoprodol] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=164 alprazolam online] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=177 cheap diethylpropion] [http://news.engin.brown.edu/forums/thread-view.asp?tid=200 nokia ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=69 albuterol online] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=357 free funny ringtones] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=334 valium online] [http://wc1.worldcrossing.com/WebX/.1de60a29 buy tramadol] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=338 fioricet online] [http://wc1.worldcrossing.com/WebX/.1de60a09 cheap viagra] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=124 samsung ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=198 mtv ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=164 norco online] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=199 free music ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=166 buy ativan] [http://news.engin.brown.edu/forums/thread-view.asp?tid=188 cheap tenuate] [http://wc1.worldcrossing.com/WebX/.1de60a17 lipitor online] [http://wc1.worldcrossing.com/WebX/.1de60a12 ericsson ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=151 soma online] [http://wc1.worldcrossing.com/WebX/.1de609df cheap ambien] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=231 order rivotril] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=343 cialis online] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=134 tramadol online] [http://news.engin.brown.edu/forums/thread-view.asp?tid=227 free ericsson ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=228 mtv ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=177 cheap propecia] [http://wc1.worldcrossing.com/WebX/.1de60a14 free jazz ringtones] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=187 kyocera ringtones] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=345 viagra online] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=348 but norco] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=162 alltel ringtones] [http://news.engin.brown.edu/forums/thread-view.asp?tid=193 buy zanaflex] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=196 free motorola ringtones] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=139 viagra online] [http://news.engin.brown.edu/forums/thread-view.asp?tid=191 cheap lortab] [http://wc1.worldcrossing.com/WebX/.1de60a1b music ringtones] [http://wc1.worldcrossing.com/WebX/.1de60a19 free mp3 ringtones] [http://wc1.worldcrossing.com/WebX/.1de609dc albuterol online] [http://www.psfc.mit.edu/~jinseok/bbse/view.php?id=presentations&no=351 buy clonazepam] [http://news.engin.brown.edu/forums/thread-view.asp?tid=171 ambien online] [http://news.engin.brown.edu/forums/thread-view.asp?tid=173 xenical online] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=121 real ringtones] [http://wc1.worldcrossing.com/WebX/.1de60a20 nexium online] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=142 wellbutrin] [http://www.ees.ufl.edu/alumni/forums.asp?ForumId=5&TopicId=130 free sonyericsson ringtones] [http://wc1.worldcrossing.com/WebX/.1de60a0e cheap celexa] [http://news.engin.brown.edu/forums/thread-view.asp?tid=158 diazepam online] [http://wc1.worldcrossing.com/WebX/.1de609f7 free nextel ringtones] [http://wc1.worldcrossing.com/WebX/.1de60a28 soma online] [http://itcweb.ecsu.edu/portal/forums.asp?ForumId=13&TopicId=197 free mp3 ringtones] {{Template:SecureSoftware}}
+
{{Template:SecureSoftware}}
 +
{{Template:Vulnerability}}
  
==Overview==
+
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
  
The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. If a system administrator can recover the password directly - or use a brute force search on the information available to him -, he can use the password on other accounts.
+
[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
  
==Consequences ==
+
==Description==
 +
The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. If a system administrator can recover the password directly, or use a brute force search on the information available to him, he can use the password on other accounts.
  
* Confidentiality: User's passwords may be revealed.
+
'''Consequences'''
  
* Authentication: Revealed passwords may be reused elsewhere to impersonate the users in question.
+
* Confidentiality: Users' passwords may be revealed.
 +
* Authentication: Revealed passwords may be reused elsewhere to impersonate the users in question.
  
==Exposure period ==
+
'''Exposure period'''
  
* Design: The method of password storage and use is often decided at design time.
+
* Design: The method of password storage and use is often decided at design time.
 +
* Implementation: In some cases, the decision of algorithms for password encryption or hashing may be left to the implementers.
  
* Implementation: In some cases, the decision of algorithms for password encryption or hashing may be left to the implementers.
+
'''Platform'''
  
==Platform ==
+
* Languages: All
 +
* Operating platforms: All
  
* Languages: All
+
'''Required resources'''
 
+
* Operating platforms: All
+
 
+
==Required resources ==
+
  
 
Access to read stored password hashes
 
Access to read stored password hashes
  
==Severity ==
+
'''Severity'''
  
 
Medium to High
 
Medium to High
  
==Likelihood   of exploit ==
+
'''Likelihood of exploit'''
  
 
Very High
 
Very High
  
==Avoidance and mitigation ==
+
The use of recoverable passwords significantly increases the chance that passwords will be used maliciously. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plain-text passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders.
  
* Design / Implementation: Ensure that strong, non-reversible encryption is used to protect stored passwords.
+
==Risk Factors==
  
==Discussion ==
+
TBD
  
The use of recoverable passwords significantly increases the chance that passwords will be used maliciously. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plain-text passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders.
+
==Examples==
 
+
==Examples ==
+
  
 
In C\C  :
 
In C\C  :
Line 73: Line 72:
 
</pre>
 
</pre>
  
==Related problems ==
 
  
* [[Use of hard-coded passwords]]
+
==Related [[Attacks]]==
  
 +
* [[Attack 1]]
 +
* [[Attack 2]]
  
[[Category:Vulnerability]]
 
  
[[Category:Protocol Errors]]
+
==Related [[Vulnerabilities]]==
  
 +
* [[Use of hard-coded passwords]]
 +
 +
 +
==Related [[Controls]]==
 +
 +
* Design / Implementation: Ensure that strong, non-reversible encryption is used to protect stored passwords.
 +
 +
 +
 +
==Related [[Technical Impacts]]==
 +
 +
* [[Technical Impact 1]]
 +
* [[Technical Impact 2]]
 +
 +
 +
==References==
 +
Note: A reference to related [http://cwe.mitre.org/ CWE] or [http://capec.mitre.org/ CAPEC] article should be added when exists. Eg:
 +
 +
* [http://cwe.mitre.org/data/definitions/79.html CWE 79].
 +
* http://www.link1.com
 +
* [http://www.link2.com Title for the link2]
 +
 +
[[Category:FIXME|add links
 +
 +
In addition, one should classify vulnerability based on the following subcategories: Ex:<nowiki>[[Category:Error Handling Vulnerability]]</nowiki>
 +
 +
Availability Vulnerability
 +
 +
Authorization Vulnerability
 +
 +
Authentication Vulnerability
 +
 +
Concurrency Vulnerability
 +
 +
Configuration Vulnerability
 +
 +
Cryptographic Vulnerability
 +
 +
Encoding Vulnerability
 +
 +
Error Handling Vulnerability
 +
 +
Input Validation Vulnerability
 +
 +
Logging and Auditing Vulnerability
 +
 +
Session Management Vulnerability]]
 +
 +
__NOTOC__
 +
 +
 +
[[Category:OWASP ASDR Project]]
 +
[[Category:Vulnerability]]
 +
[[Category:Protocol Errors]]
 
[[Category:OWASP_CLASP_Project]]
 
[[Category:OWASP_CLASP_Project]]

Latest revision as of 16:02, 28 February 2009

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.


Last revision (mm/dd/yy): 02/28/2009

Vulnerabilities Table of Contents

Description

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. If a system administrator can recover the password directly, or use a brute force search on the information available to him, he can use the password on other accounts.

Consequences

  • Confidentiality: Users' passwords may be revealed.
  • Authentication: Revealed passwords may be reused elsewhere to impersonate the users in question.

Exposure period

  • Design: The method of password storage and use is often decided at design time.
  • Implementation: In some cases, the decision of algorithms for password encryption or hashing may be left to the implementers.

Platform

  • Languages: All
  • Operating platforms: All

Required resources

Access to read stored password hashes

Severity

Medium to High

Likelihood of exploit

Very High

The use of recoverable passwords significantly increases the chance that passwords will be used maliciously. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plain-text passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders.

Risk Factors

TBD

Examples

In C\C  :

int VerifyAdmin(char *password) {
 
  if (strcmp(compress(password), compressed_password)) {
    printf("Incorrect Password!\n");
    return(0)
  }

  printf("Entering Diagnostic Mode�\n");
  return(1);
}

In Java:

int VerifyAdmin(String password) {
  
  if (passwd.Eqauls(compress((compressed_password)) {
    return()0)
  }
//Diagnostic Mode
  return(1);
}


Related Attacks


Related Vulnerabilities


Related Controls

  • Design / Implementation: Ensure that strong, non-reversible encryption is used to protect stored passwords.


Related Technical Impacts


References

Note: A reference to related CWE or CAPEC article should be added when exists. Eg: