0

I have an application running locally and to access the application, a user has to login using a user name and password. At the time of login, the provided password is hashed and compared to exiting hashed password.

The application uses a database and stores users credentials in a users table. The users table has columns to store user id, user name and one way hashed password for users.

The application hashes user passwords at time of user creation or change of password by the users. The hashing returns different hashes for two users with same password. The hashed password is stored within the table together with the number of iterations (generated randomly) used to hash the password. Example: 2CF7C.ABLK/hrjy...zCOI5A=

One weakness I have found is that if the database gets compromised by an existing user, that user can update another user's password with their own password. The malicious user can then use credentials of compromised user to access the application.

In mitigation of the weakness, I intend to hash the either user id, user name or both and store them together with the password. At login, a check is made of the hashed user id and password and if they don't match, the login fails.

Is there a better alternative of how to handle this weakness?

kagundajm
  • 962
  • 1
  • 12
  • 26
  • 1
    Once your DB is compromised you cannot rely on user data anymore because it might have been changed - adding more steps (e.g. adding user ID as hash salt) to the process doesn't make it any harder to the attacker (he/she can replicate all that you can over the same piece of data). – zwer May 27 '17 at 04:21

1 Answers1

1

Well if the attacker has access to the database and he replaces the password of some user A with his own password, then the attacker can login as user A using his own password.

To avoid such problems you should protect your application from SQL injection attacks. This will reduce the chances of your database being compromised.

Another precaution that you can take is to use multi factor authentication on your website. https://en.wikipedia.org/wiki/Multi-factor_authentication. Even if the user is able to compromise your database and update passwords of other users, he will still have to pass the other authentication schemes.

Nadir Latif
  • 3,223
  • 1
  • 13
  • 22