749
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review
(not inspections)
Effectiveness = High
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Source code Weakness Analyzer Context-configured Source Code Weakness
Analyzer
Effectiveness = SOAR Partial
Automated Static Analysis
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Configuration Checker
Effectiveness = SOAR Partial
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE
1028 standard) (can apply to requirements, design, source code, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Common protection mechanisms include: Disconnecting the user after a small number of failed
attempts Implementing a timeout Locking out a targeted account Requiring a computational task
on the user's part.
Phase: Architecture and Design
Strategy = Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides
constructs that make this weakness easier to avoid. Consider using libraries with authentication
capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
Demonstrative Examples
Example 1:
In January 2009, an attacker was able to gain administrator access to a Twitter server because the
server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of
Twitter's support team and was able to successfully guess the member's password using a brute
force attack by guessing a large number of common words. After gaining access as the member
of the support staff, the attacker used the administrator panel to gain access to 33 accounts that
belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared
to come from the compromised accounts.
Example 2:
The following code, extracted from a servlet's doPost() method, performs an authentication lookup
every time the servlet is invoked.
Example Language: Java (Bad)
String username = request.getParameter("username");
String password = request.getParameter("password");
int authResult = authenticateUser(username, password);
CWE Version 4.14
CWE-307: Improper Restriction of Excessive Authentication Attempts
CWE-307: Improper Restriction of Excessive Authentication Attempts