Description

The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.

Applicable Platforms
Language Class: Language-independent

Time Of Introduction

• Architecture and Design

Related Attack Patterns

• CAPEC-49
• CAPEC-112
• CAPEC-16
• CAPEC-55
• CAPEC-70

Common Consequences

Detection Methods
None

Potential Mitigations

Relationships

Demonstrative Examples   (Details)

1. In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. Once the attacker gained access as the member of the support staff, he used the administrator panel to gain access to 33 accounts that belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared to come from the compromised accounts.
2. In the following C/C++ example the validateUser method opens a socket connection, reads a username and password from the socket and attempts to authenticate the username and password.
3. The following code, extracted from a servlet's doPost() method, performs an authentication lookup every time the servlet is invoked.
4. This code attempts to limit the number of login attempts by causing the process to sleep before completing the authentication.

Observed Examples

1. CVE-1999-1152 : Product does not disconnect or timeout after multiple failed logins.
2. CVE-2001-1291 : Product does not disconnect or timeout after multiple failed logins.
3. CVE-2001-0395 : Product does not disconnect or timeout after multiple failed logins.
4. CVE-2001-1339 : Product does not disconnect or timeout after multiple failed logins.
5. CVE-2002-0628 : Product does not disconnect or timeout after multiple failed logins.
6. CVE-1999-1324 : User accounts not disabled when they exceed a threshold; possibly a resultant problem.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings

References:

1. OWASP .OWASP Enterprise Security API (ESAPI) Project.