Password Management: Weak Cryptography

ABSTRACT

采用一些簡單的編碼方式給密碼加密并不能有效地保護密碼。

EXPLANATION

當密碼以明文形式存儲在應用程序的屬性文件或其他配置文件中時，會發生 password management 漏洞。程序員試圖通過編碼函數來遮蔽密碼，以修補 password management 漏洞，例如使用 64 位基址編碼方式，但都不能起到充分保護密碼的作用。


示例：以下代碼可以從屬性文件中讀取密碼，并使用該密碼連接到數據庫。

...
01  RECORD.
05  UID              PIC X(10).
05  PWD              PIC X(10).
...
EXEC CICS
READ
FILE('CFG')
INTO(RECORD)
RIDFLD(ACCTNO)
  ...
END-EXEC.

PERFORM BASE-64-ENCODING.

EXEC SQL
CONNECT :UID
IDENTIFIED BY :PWD
AT :MYCONN
USING :MYSERVER
END-EXEC.
...

這組代碼可以順利運行，但是任何對 CFG 具有訪問權限的人都能讀取密碼的值，并且很容易確定這個值是否經過 64 位基址編碼。而這給了心懷不軌的雇員利用這一信息破壞系統的機會。

REFERENCES

[1] Standards Mapping - OWASP Top 10 2010 - (OWASP 2010) A7 Insecure Cryptographic Storage

[2] Standards Mapping - OWASP Top 10 2007 - (OWASP 2007) A8 Insecure Cryptographic Storage

[3] Standards Mapping - OWASP Top 10 2004 - (OWASP 2004) A8 Insecure Storage

[4] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP3150.1 CAT II

[5] Standards Mapping - Security Technical Implementation Guide Version 3.4 - (STIG 3.4) APP3150.1 CAT II

[6] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 261

[7] Standards Mapping - FIPS200 - (FISMA) IA

[8] Standards Mapping - Web Application Security Consortium 24 + 2 - (WASC 24 + 2) Information Leakage

[9] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 - (PCI 1.2) Requirement 3.4, Requirement 6.3.1.3, Requirement 6.5.8, Requirement 8.4

[10] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 - (PCI 2.0) Requirement 3.4, Requirement 6.5.3, Requirement 8.4

[11] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 - (PCI 1.1) Requirement 3.4, Requirement 6.5.8, Requirement 8.4

97av