Every Solution You Can Imagine – and More
What cybersecurity solution do you need? From Zero Trust to ADR, IAM, risk/privacy, data protection, AppSec and threat, securing digital transformation, to resiliency and remediation, we can build the right program to help solve your challenges.
A Single Partner for Everything You Need
Optiv works with more than 400 world-class security technology partners. By putting you at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can.
We Are Optiv
Greatness is every team working toward a common goal. Winning in spite of cyber threats and overcoming challenges in spite of them. It’s building for a future that only you can create or simply coming home in time for dinner.
However you define greatness, Optiv is in your corner. We manage cyber risk so you can secure your full potential.
From Low to p0wn (Part 3 of 3)
This series explores the potential risk of de-prioritizing and ignoring low severity application vulnerabilities. In the first installment of this series, we looked at information disclosure due to security misconfiguration. In the second installment, we explored examples of vulnerability stacking. In the final installment, we will again be looking at an instance of vulnerability stacking, this time, however, we’ll be focused on account management.
I have seen the set of issues I will discuss in this post all reported as low severity. I have also seen instances where the severity has been increased due to the ability to combine the vulnerabilities associated with an application to perform a more advanced attack. This analysis of the vulnerabilities is a significant benefit to having a true application penetration test performed rather than a tools-based vulnerability scan.
The majority of web applications continue to use a simple username and password form for authorization. The combination of vulnerabilities we’ll examine is username enumeration, weak password requirements, and lack of account lockout.
Username enumeration comes in many flavors. The majority of applications I’ve assessed have stopped returning specific errors on login telling the user if the account name or password are incorrect. Its most common form recently is in the “forgot password” process for an application. Another common instance is an error message during account creation notifying the user that an account name has already been created. The screenshot below demonstrates one example where a username, email in this case, was enumerable through the account registration process.
Figure 1: Usernames enumerated through brute force
Once an attacker is able to identify valid usernames, the next step in exploitation is associating a password to the account. This is easily automated and is made trivial if the application does not lock out accounts after a set number of failed attempts. In this case, the attacker can potentially try thousands of passwords in a matter of minutes. If users are able to use weak passwords, there is likely not even a need to try that many passwords before an attacker is able to take over an account.
Most users, given the opportunity, will choose poor passwords for their accounts. The following list shows 25 of the most commonly used passwords. These change a little from year to year depending on popular culture events and what the source of the password list is, but the top 10 are fairly consistent.
These three fairly common web application vulnerabilities are sufficient to lead to an account takeover. Many times, application scanning tools won’t even identify these vulnerabilities, and when they do, the significance of the combination of vulnerabilities is seldom recognized.
Throughout this series we have investigated a number of issues that commonly go unresolved due to their low severity. These issues when taken individually, at the time of the assessment, may pose little risk, but given the evolving landscape of vulnerabilities, that risk must be reviewed regularly. Additionally, it is important to view all of the application vulnerabilities and evaluate the risk associated when vulnerabilities can be combined to create a more significant attack scenario.
October 11, 2017
Optiv’s managed vulnerability services identify, prioritize and reduce network vulnerability exposure.
Let us know what you need, and we will have an Optiv professional contact you shortly.