21–30 of 44 posts
He also realized he hadn't used a proxy to hide his IP address, potentially making him traceable. He didn't think the intrusion was important draw for law-enforcement attention, and "didn't think it would make headlines. I don't understand how he thought hi-jacking Obama, Britney and Fox News twitter accounts wouldn't make headlines.
This is why ideally you only make your admin tools available on your private network, accessible only via VPN. The very minimum is restricting access to admin functionality to specific IP addresses. Limiting password check attempts is important too, but if all a bad guy could get access to is user accounts the damage is significantly less.
This does bring up a good tech question -- how do you prevent people from doing a rapid password attack? Anyone have an article or some ideas on how this could be done? Is limiting attempts the simplest way? Even if you do limits, aren't these session-based? I'm guessing a cracker isn't going to respect sessions.
Presume that you have some sort of table with userIDs and password hashes (with salt). You should also consider adding some columns like: 1 - LastLoginAttemptedDateTime 2 - LastLoginAttemptedIPAddress 3 - LastSuccessfulLoginDateTime 4 - LastSuccessfulLoginIPAddress 5 - MustChagePasswordAtNextLogin - a boolean flag to indicate they must change their password. You'll set that flag when they're recovering a password, or…
This is why ideally you only make your admin tools available on your private network, accessible only via VPN. The very minimum is restricting access to admin functionality to specific IP addresses. Limiting password check attempts is important too, but if all a bad guy could get access to is user accounts the damage is significantly less.
Limiting attempts is a great way to allow people to remotely execute a DoS on your admin site. They can keep you out for awhile before you block them. If your company has a password lockout policy, keep guessing the CEO or CIOs password constantly for a few days and the policy will be changed pretty quickly. The other suggestions are good.
This is why ideally you only make your admin tools available on your private network, accessible only via VPN. The very minimum is restricting access to admin functionality to specific IP addresses. Limiting password check attempts is important too, but if all a bad guy could get access to is user accounts the damage is significantly less.
Limiting attempts is a great way to allow people to remotely execute a DoS on your admin site. They can keep you out for awhile before you block them. If your company has a password lockout policy, keep guessing the CEO or CIOs password constantly for a few days and the policy will be changed pretty quickly. The other suggestions are good.
Classic
Earlier quoted context omitted.
Presume that you have some sort of table with userIDs and password hashes (with salt). You should also consider adding some columns like: 1 - LastLoginAttemptedDateTime 2 - LastLoginAttemptedIPAddress 3 - LastSuccessfulLoginDateTime 4 - LastSuccessfulLoginIPAddress 5 - MustChagePasswordAtNextLogin - a boolean flag to indicate they must change their password. You'll set that flag when they're recovering a password, or…
And if the attacker doesn't care which userID they compromise, so they spread their guesses over all userIDs?
Small user sets, such as the Twitter admin accounts, would not be large enough to be successful with a horizontal attack. Provided, of course, that every user has a minimum password complexity, which they did not. Even without complexity requirements, the list of simple words is still prohibitively large in most cases.
That said, if you have even one user among millions with the password "qwerty", he is certainly at risk. However, once you are at a scale prone to this kind of attack, a more sophisticated rate limiting scheme is probably required even for regular web requests.
He also realized he hadn't used a proxy to hide his IP address, potentially making him traceable. He didn't think the intrusion was important draw for law-enforcement attention, and "didn't think it would make headlines. I don't understand how he thought hi-jacking Obama, Britney and Fox News twitter accounts wouldn't make headlines.
He was hijacking a random account on some totally unknown site called twitter.
I know this is hard to grasp outside the valley, but most people have not ever heard about twitter and will probably assume it's about as important to the internet as zombo.com.
Earlier quoted context omitted.
You could just throw recent login attempts into a table, but that might get big quickly.
why even bother logging that? just store it in memory someone. have a counting bloom filter remember the set of IPs that tried to login during the last 10 seconds. If your ip is in that set, delay the user by 10 seconds or so...
"He said he'd never even heard of Twitter until he saw someone mention it on YouTube." Classic
I've noticed sometimes the tech world feels like a bubble where our sense of what's important in the "real world" gets warped.