[MUSIC]
Hi there.
In this lesson,
we're going to talk about the third issue, which is improperly storing passwords.
We're going to quickly talk about a real life example.
And then I'm going to introduce how brute forcing passwords work, and
some mitigations that you can apply in order to mitigate this issue.
At the end of this lesson, you will be able to explain how password
brute forcing works and describe some ways to mitigate the issue.
Let's dive in.
One real life example is one from 2017.
The data was available but the breach that actually happened was around 2015.
This happened to a Czech online shopping gallery called Mall.
They were initially using some outdated and
insecure password hashing schemes, for example, MD5 salted with SHA-1.
Until about October 2016, then in October 2016 they switched over to bcrypt.
Which is good, but most of the passwords that were involved in
the leak was from when they were using MD5 as the hashing algorithm.
Now, one way that the web application developer could store passwords that
are not in plain text is the following example.
But please note that this example is not secure,
this is just to show you what one think that can be tried.
But that is not really secure.
So in this example, the web application would take in
the user name of beebo, and this password of %iam$am.
And the password is then put through a cryptographic hash function.
For example, SHA-256.
So a cryptographic hash function is secure in that when you
have some plain text input into this hash function,
the output that is generated can't be computed to get the plain text back.
So you can't go backwards from the hash output.
So with that said, that's why it's called one way.
Now, the output of this harsh function is what is stored in the database along with
the username.
So at no point in time is a plan text pass code ever stored, so that's a good try.
So what attackers can do is steal the database, but
they only have the hash of the passwords for each username.
In essence the idea is to store the password information but
not the actual plain text password.
That is key, and that's the idea.
However, one thing that the attacker can do once they have stolen this database is
to use a word list, so a very large list of possible words that people tend to use.
And they take this word list, and they perform the same one-way hash function
computation on each of the words in this word list.
And once they have the hash, they can check to see if they have a hash that
matches in the database that they have just stolen.
If they do have a match, then they know that they have the right plaintext
password, which is located in the word list.
An attacker can also perform password brute force calculations.
So what they would do is to try every combination of characters up to a certain
length and perform the hash for each try.
And then compare the hash calculation with what they have in their stolen database.
So that's what password brute force looks like in general.
Attackers can have really strong beefy hardware,
GPUs to perform these calculations.
So based on the previous example, furthermore, if for example two users have
the same password, then that means then the same hash is stored at least twice.
So if two users have the same password then two hashes
are the same, and that's stored in the database.
So then that means the attacker has a higher chance of knowing what the actual
password is.
But for our next video we can do things to mitigate this.
I alluded to this earlier when I mentioned the term salt.
So we will talk about how to use that in the next video.
So here are some general prevention strategies for
when you develop your web application.
What you can do is to use some salt and
use specific hash functions that slow down password brute force attempts.
I will get to what that means in the next video.
You can also set up your web application to use 2-Factor Authentication.
So that your users don't need to just rely
on a password to identify themselves in the web application.
And also, one other thing that's very simple
is to create a generic user message when the password attempt is incorrect.
So that's harder for an attacker to determine whether it was an issue of
a username being incorrect or a password was incorrect.
So they won't be able to determine that.
So in summary, we talked about issues with improperly storing passwords, and
I mentioned one real life example of what has happened.
And I mentioned a very brief introduction on how password brute-force attempts work.
And I also mentioned some things you can do to mitigate this issue.
That's it for now, thanks for listening.