Professional ASP.NET Security - Jeff Ferguson

Implementing Password Policies

This method checks the length of the password and displays the error message when the length of the password is less than seven characters.

You should allow the users to enter a long password, since the longer the password, the harder it is to crack.

Requiring Mixed Case Password

Requiring mixed cases in the password also makes them harder to crack. We can get this functionality by using the custom validator at the server side. We could construct our mixed-case checking code in the following way:

bool validateMixedCase(String sPWD)

bool foundLower, foundUpper; foundLower=false; foundUpper=false;

for (int 1=0; i< sPWD.Length; i++)

if (foundLower==false) foundLower=isLower(sPWD[i]);

if (foundUpper==false) foundOpper=isUpper(sPWD[i]);

if (foundLower==true && foundUpper==true) return true ;

else

return

false; }

We loop through all the characters in the string, and check whether the current character is an upper or lower case character. Since C# doesn't support isLower and isUpper methods, we've built our own methods for this:

bool isLower(char ch)

if (ch >= 'a1 && ch <= ' z 1 ) return true;

else

return false;

bool isUpper(char ch)

if (ch >= 'A' && ch <= 'Z1) return true;

else

return false;

93

Requiring Numbers and Symbols

Although allowing many characters for the password can make it more secure, and hard to guess, it could leave us open to other types of attack. So it is necessary to limit the number of characters that are supported by passwords. Usually, the characters A-Z, a-z, 0-9, and a few special characters (!, @, #, $, ", *, ?, /, \) are safe to use. To check for numbers and symbols, we're going to modify the validateMixedCase method a little bit:

bool validateMixedCase(String sPWD)

bool foundLower, foundUpper, foundNumeric, foundSymbol; foundLower=false;

foundUpper=false;

foundNumeric=false,•

foundSymbol=false;

for (int i=0; i< sPWD.Length; i++)

if (foundLower==false) foundLower=isLower(sPWD[i]);

if (foundUpper==false) foundUpper=isUpper(sPWD[i]);

if (foundNumeric==false) foundNumeric=isNumeric(sPWDti]); if

(foundSymbol==false)

foundSymbol=isSpecialCharacter(sPWD[i]);

if (foundLower==true && foundUpper==true && foundNumeric==true && foundSymbol==true) return true; else

return

false; }

Since C# doesn't support isNumeric and isSymbol methods, we'll to write our own methods to differentiate between numerals and other types of symbols:

bool isNumeric(char ch)

if (ch >= '0' && ch <= '9') return true;

else

return false;

bool isSpecialCharacter(char ch) { if (ch == '!')

return true; else if (ch == '@') return true; else if (ch == '#')

94

Implementing Password Policies

return true else if (ch == '$ ) return true else if (ch == '" ) return true

else if (ch == '* ) return true else if (ch == '? ) return true

else if (ch == '/ ) return true

else if (ch == ' \V ) //Watch for the special character return true

else

return false;

If you are storing passwords in a database or Active Directory, check the special characters supported by the password store. The best way to restrict the password characters is by using regular expressions. Remember not to allow characters that may be used in script attacks.

If you want to learn more about regular expressions, then you may be interested in "Mastering Regular Expressions - Powerful Techniques for Perl and Other Tools" (ISBN: 1-56592-257-3) By Jeffrey E. F. Friedl from Oreilly Associates. Here is few other good links for information on Regular Expressions:

Q Introduction to Regular Expressions

http://msdn.microsoft.com/scripting/default.htm7/scripting/vbscript/doc/reconlntroduction

ToRegularExpressions.htm

Q Regular Expression Syntax http://msdn.microsoft.com/scripting/default.htm7/scripting/vbscript/doc/jsgrpregexpsyntax.htm

a HOW TO: Match a Pattern Using Regular Expressions and Visual Basic .NET (Q301264) http://support.microsoft.com/default.aspx?scid=kb;EN-US;q301264

Q Learning to Use Regular Expressions by Example http://www.phpbuilder.com/columns/dario1 999061 6. php3

Q PHP and Regular Expressions 101 http://www.webreference.com/programming/php/regexps/

Running a Dictionary Check on New Passwords

Tools such as LOphtCrack (LOphtCrack is available at http://online.securityfocus.com/tools/1005) use directory check methods to simulate passwords. This means that each of the tools will have its own directory of characters or words that it will use to crack the password. For example, suppose your login page accepts the login parameters in the URL:

Login.Aspx?UserID=Ssivakumar&Password=Checkthisout The directory check tool

could try to fake the URL with different combination of passwords:

Login. Aspx?UserID=Ssivakumar&Password=lCheckthisout

Login.Aspx?UserID=SsivakumarkPassword=2Checkthisout

Login.Aspx?UserID=Ssivakumar&Password=3Checkthisout

Login. Aspx?UserID=Ssivakumar&Password=4Checkthisout

Login.Aspx?UserID=Ssivakumar&Password=5Checkthisout

This is called a Brute Force Attack. In this way, we can also simulate the HTTP POST method to send data:

UserID=Ssivakumar&Password=lCheckthisout

UserID=Ssivakumar&Password=2Checkthisout

User ID=SsivakumarScPassword=3Checkthi sou t

The result of this is that if you've used any common words in your password, then it will be very easy to crack.

Let's build a small application that simulates passwords. Our .NET application is going to get passwords from a text file and use the passwords to crack the web application. Here is the ASP.NET web application source.

Else IblPass.Text = strPass End If

EnableControls(True)

IblEnd.Text = DateTime.Now.TimeOfDay.ToStringl) End If End Sub

We disable the textboxes and the go button first by calling the EnableControls method. Then we display the start time in a label. After that, we call the ReadPasswordFile method. If an empty string is returned by the ReadPasswordFile method then we know we're unable to crack the password and the user didn't choose the common words found in the Password. Txt file. If we found the password then we'll display it in the label control and we'll display the end time.

The ReadPasswordFile method is constructed in the following way:

=Application.ExecutablePath.Substring(0, _

Application.ExecutablePath.IndexOf("bin") - 1)

We get the path of the application directory here. Since the Application. ExecutablePath property returns path of the bin folder, we have to trim the bin folder from the path.

Try

Dim objStrmRds As StreamReader = File.OpenText(strPath & _ "\"&strFileName)Do

strPass = objStrmRds.ReadLine()

Then we open the file using the StreamReader object and reading the file line by line. Then we build the URI dynamically using the URL, username, and password and passing it to the crackPassword method.

If the crackPassword method returns True then we know this is the password. Therefore, we quit from the Do loop and returning the password back to the Go buttons click event.

98

Implementing Password Policies

Otherwise, we add the tried password to the ListBox and increment the counter variable to count the number of passwords that we've tried.

Here is the code for the crackPassword method. The crackPassword method uses the WebRequest and WebResponse classes found in the System.Net namespace.

blnFound = False

Try

Dim objWebReq As WebRequest Dim

ReceiveStream As Stream Dim objEn

As Encoding Dim objStmRdr As

StreamReader

objWebReq = WebRequest.Create(url) objWebRspn = objWebReq.GetResponse() ReceiveStream = objWebRspn.GetResponseStream() objEn = System.Text.Encoding.GetEncoding("utf-8") objStmRdr = New StreamReader(ReceiveStream, objEn)

Dim chrReadBuffer(256) As Char

Dim chrBufferCntr As Integer = objStmRdr.Read(chrReadBuffer, 0, 256)

We create a WebRequest object and pass the URL to its constructor. Then we use the GetResponse method of the WebRequest object to read the return data from the web page and store into the WebResponse object.

After doing the formatting, we read the 256 characters from the output stream. If the current character contains the word "Hello", then we know that the authentication was successful.

QQ

unapier o

'Check if the stream object has the word "Hello" in it. If 'so then we know the authentication is sucessfully happened 'and the current password is the one that can be used to get 'into the system. If strTemp.IndexOf ( "Hello") > 0 Then

blnFound = True Exit Do

End If

Then we return True back to the crackPassword method and we quit from the Do loop. Otherwise, we move to the next part of the output stream.

chrBuf ferCntr = objStmRdr .Read(chrReadBuf fer , 0, 256) Loop Catch Exc As Exception

Mes sageBox. Show ( "The request URI could not be found or was malformed"

, "URL Error", MessageBoxButtons .OK, MessageBoxIcon. Stop, _

MessageBoxDefaultButton.Buttonl) End Try

'If the WebResponse object is not nothing then close it If Not objWebRspn Is Nothing Then objWebRspn. Close ()

'Rturn data Return blnFound End Function

Let's run the .NET Crack application and see how the application works:

.NET Creak Parameter-

ittp.j'/localhosrvCHlfc, Login A.,p

Password: |DQntTellAnyOne

Tried Passwords:

As you can see, the password DontTellAnyOne was present in the Password, txt file, so that our application was able to find the password. More sophisticated applications will use common words from a directory and number and letter combinations.

100

Implementing Password Policies

This application simulated the HTTP GET method. We can also use the HTTP POST method with the WebRequest object by using the Method property.

Requiring Password Updates

We should suggest that users change their password frequently: once every three months, for instance. We could use a simple table in which will store the user ID, username, password, the last time the password was changed, and the locked time stamp.

Column Name

UserlD

UserName

Password

LastTimePasswordChanged

NeedToChangePassword

GUID

Locked

LockedTimeStamp

When we authenticate the user, we can check the time stamp. If the interval between the time stamp and the current time is greater than a specified time period, then we should force users to change their passwords. We'll look at the NeedToChangePassword, GUID, Locked, and LockedTimeStamp columns a little later.

When we force the users to change their passwords, we shouldn't allow them to use any of their three prior passwords. We can achieve this functionality by keeping track of the user's passwords in a history table.

Column Name

UserlD

Password

InstanceNumber

Every time the user changes their password, we should place the old password in this table, with an instance number.

Table continued on following page

1O1

When the user changes a password, get all the previous passwords sorted in the descending order of the InstanceNumber column, then compare the new password with the last three passwords. If they match, then notify the user that they can't use any of their last three passwords.

Choosing Random Passwords for Users

Sometimes, we have to assign a random password for users. This could be when the user account is created, or when the user has forgotten their password. We can use the System.Random class to generate random passwords, as in the following example:

<script languages"C#" runat="server">

void InsertData_Click(Object sender, EventArgs e)

{

System.Random oRand = new System.Random)); IblRandom.Text = Convert.ToString(oRand.Next()); }

</script>

Helping Users Who have Forgotten their Password

Users will often forget their passwords and pester administrators to let them back in. However, we need to take into account that a hacker might try requesting a 'lost' password. We need to put security checks in place to prevent passwords from falling into the wrong hands.

E-Mailing New Passwords to Users

The best way to deal with this problem is assign a new random password to the account, and send the password to the user's primary e-mail address. This will ensure that we minimize the risk that a new password will be exposed. We can also create a new column called NeedToChangePas sword in the users table, enabling the flag to True, in order to indicate that when the user next logs in, they must change the password. This will allow them to choose their own personal password, which will be easier to remember.

E-Mailing a 'change password' Link

When we send the password to the user, we should also send a special URL that includes some special values. For example, we could generate a new random number or GUID (Globally Unique Identifier), and pass it as a part of the URL. The System. Quid class can be used to generate GUID numbers.

102