Re: Script Based Attacks & Form Hacks

[Vicente Aguilera <vaguilera () isecauditors com>]

Hi,

CAPTCHA is a good solution to prevent automatic form submissions, but:

"Greg Mori and Jitendra Malik of the University of California at 
Berkeley have written a program that can solve ez-gimpy with accuracy 
83% (see Breaking a Visual CAPTCHA for details). Thayananthan, Stenger, 
Torr, and Cipolla of the Cambridge vision group have written a program 
that can achieve 93% correct recognition rate against ez-gimpy..." 
(www.captcha.net)

If you use CAPTCHA, CAPTCHA-PIX is probably the best option.
We have to remember that CAPTCHA does not guarantee the security. The 
implementation and the validation also must be realized correctly.

To prevent automatic form submissions in login forms you can also use:

1. One-time-logins/One-time-passwords
For example, if the user password is: "a34.;(vad78!$" the application 
can ask for the password: "Put the character 1,5,2,6,8,9,10,4 of your 
password", and these positions could change randomly.

2. Account lock
For example after 5 unsuccessful attempts.


Vicente Aguilera Díaz
OPST, OPSA, ITIL
vaguilera () isecauditors com



Paul Kurczaba escribió:

> To prevent automatic form submissions I use a custom written 
> implementation of CAPTCHA (http://www.captcha.net/). This prevents 
> robots from automatically setting up accounts. Many web developers do 
> use client side JavaScript for controlling form submission data (ex. 
> making sure all text boxes are filled, verifying email address 
> structure, etc.) This is unprofessional and (could be) insecure. The 
> form verification should be done on the server side.
>
> The following page I have set up:
> http://www.securinews.com/login/register.htm
> uses CAPTCHA to help prevent automatic submissions. If the CAPTCHA 
> string is not entered, the form will not be processed by the server. 
> You are free to create a Java program to test bypassing CAPTCHA.
>
> -Paul
>
>
> Chad Maniccia wrote:
>
> > Hi List,
> >
> > One thing I have not heard any one discuss is the use of automated
> > scripts and form hacking. I could easily write a Java program to
> > attack any ASP,JSP,PHP etc.. simply by viewing the page source to find
> > the parameters the form processor will be looking for. You could use
> > this to fill up some ones database with garbage bring the server to a
> > standstill or worse yet bypass all the fancy javascript you had on the
> > calling page. Some web applications actually use javascript to
> > calcualte currency transactions.
> >
> > What ideas do you guys have to protect yourself from these?
> >
> >
> > Thanks,
> > Chad