{"action":"created","issue":{"url":"https://api.github.com/repos/SGCSRelease/AwesomeTitle/issues/99","repository_url":"https://api.github.com/repos/SGCSRelease/AwesomeTitle","labels_url":"https://api.github.com/repos/SGCSRelease/AwesomeTitle/issues/99/labels{/name}","comments_url":"https://api.github.com/repos/SGCSRelease/AwesomeTitle/issues/99/comments","events_url":"https://api.github.com/repos/SGCSRelease/AwesomeTitle/issues/99/events","html_url":"https://github.com/SGCSRelease/AwesomeTitle/issues/99","id":141482895,"number":99,"title":"MITM공격에 따른 password 노출 취약점","user":{"login":"taeguk","id":9107889,"avatar_url":"https://avatars.githubusercontent.com/u/9107889?v=3","gravatar_id":"","url":"https://api.github.com/users/taeguk","html_url":"https://github.com/taeguk","followers_url":"https://api.github.com/users/taeguk/followers","following_url":"https://api.github.com/users/taeguk/following{/other_user}","gists_url":"https://api.github.com/users/taeguk/gists{/gist_id}","starred_url":"https://api.github.com/users/taeguk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/taeguk/subscriptions","organizations_url":"https://api.github.com/users/taeguk/orgs","repos_url":"https://api.github.com/users/taeguk/repos","events_url":"https://api.github.com/users/taeguk/events{/privacy}","received_events_url":"https://api.github.com/users/taeguk/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/SGCSRelease/AwesomeTitle/labels/%EA%B8%B0%EC%A1%B4%20%EA%B8%B0%EB%8A%A5%EC%97%90%EC%84%9C%EC%9D%98%20%EB%B2%84%EA%B7%B8","name":"기존 기능에서의 버그","color":"e11d21"},{"url":"https://api.github.com/repos/SGCSRelease/AwesomeTitle/labels/%EC%83%88%20%EA%B8%B0%EB%8A%A5%20%EC%9A%94%EC%B2%AD","name":"새 기능 요청","color":"207de5"},{"url":"https://api.github.com/repos/SGCSRelease/AwesomeTitle/labels/%EC%84%B1%EC%A7%80%EC%88%9C%EB%A1%80","name":"성지순례","color":"fad8c7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":17,"created_at":"2016-03-17T05:12:48Z","updated_at":"2016-03-17T14:19:53Z","closed_at":null,"body":"![aa](https://cloud.githubusercontent.com/assets/9107889/13836931/d2b8b42a-ec49-11e5-969a-909650835933.PNG)\r\n회원가입하는 부분에서 password를 암호화하지 않아 네트워크 상에서 중간자공격을 당할 시, password가 그대로 노출되는 취약점이 있습니다. (로그인, 비밀번호 변경 부분에도 같은 취약점 존재)\r\n해결방법은 sha512같은 단방향 해쉬 알고리즘을 사용하여 password를 암호화한 후 서버로 전송하면 됩니다.\r\nhttp://pajhome.org.uk/crypt/md5/sha512.html\r\n등을 이용하여 javascript단에서 form 전송 시 password를 sha512로 hash해주면 좋을 것 같습니다."},"comment":{"url":"https://api.github.com/repos/SGCSRelease/AwesomeTitle/issues/comments/197899240","html_url":"https://github.com/SGCSRelease/AwesomeTitle/issues/99#issuecomment-197899240","issue_url":"https://api.github.com/repos/SGCSRelease/AwesomeTitle/issues/99","id":197899240,"user":{"login":"taeguk","id":9107889,"avatar_url":"https://avatars.githubusercontent.com/u/9107889?v=3","gravatar_id":"","url":"https://api.github.com/users/taeguk","html_url":"https://github.com/taeguk","followers_url":"https://api.github.com/users/taeguk/followers","following_url":"https://api.github.com/users/taeguk/following{/other_user}","gists_url":"https://api.github.com/users/taeguk/gists{/gist_id}","starred_url":"https://api.github.com/users/taeguk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/taeguk/subscriptions","organizations_url":"https://api.github.com/users/taeguk/orgs","repos_url":"https://api.github.com/users/taeguk/repos","events_url":"https://api.github.com/users/taeguk/events{/privacy}","received_events_url":"https://api.github.com/users/taeguk/received_events","type":"User","site_admin":false},"created_at":"2016-03-17T14:19:53Z","updated_at":"2016-03-17T14:19:53Z","body":"어떻게 보면 99%냐 99.9%냐의 얘기같은데,\r\n서버가 해킹당했을 때 해커가 무엇을 할 지 가연성을 따지는 것을 떠나서, 만약 그것이 user의 raw password를 알아내는 것이라고 가정했을 때, javascript로 hashing을 한 경우가 보안이 더 뛰어날 것이라는 점이에요~"}}