RE: Account Lockouts

Hello Dean,

In many environnements, the helpdesk could be able to call back the user
on a known telephone number.
This method also has its flaws, but is quite common in corporate
environments.
Similarly, banks should have their customers' telephone number in their
records.

Best regards,

Skander Ben Mansour, CISSP
---
http://www.benmansour.net/


-----Original Message-----
From: Dean Saxe [mailto:[email protected]] 
Sent: Thursday, December 02, 2004 4:49 PM
To: 'David LeBlanc'; Harrison Gladden; [email protected];
[email protected]
Subject: RE: Account Lockouts


Even if the user calls, how do I know you are the user in question and
not someone impersonating the user?  I don't have a great answer for
this and its a question that comes up regularly when dealing with locked
out accounts or resetting passwords.  


-dhs

Dean H. Saxe, CEH
Manager of Web Application Security
Digital Insight, Magnet Business Solutions [email protected] 
770-349-1514 
"In theory, theory and practice are the same. In practice, they are
not."

Please be advised that the information contained in this communication
may be confidential and is intended only for the use of the individual
or entity named above. Any other use, dissemination, distribution or
copying of this communication is strictly prohibited. If you are not the
intended recipient, please notify the sender immediately and delete this
message.


-----Original Message-----
From: David LeBlanc [mailto:[email protected]] 

This depends on the asset you're trying to protect. If it is a bank,
maybe I want to force someone to call.

This would be hard to implement, but if you could also track the source
IP of the logon, you could then only allow some small number of user
names to be tried from any one IP address. Won't protect you from an
army of bots, but ought to get rid of most of the anklebiters. You may
run into problems with large proxies if you use this approach, but
again, this depends on your use scenario.

Injecting some randomization into the user names would make sense. Make
the attacker guess as much as possible.

-----Original Message-----
From: Harrison Gladden [mailto:[email protected]] 

Hello all, 

My question to the group is about handling account lock outs.  Here's
the situation, assume there is a web interface that lets users log in
and do stuff, but the log-in process is constrained by the network
restrictions as well.. Meaning if a user tries to log in X times in Y
seconds and fails each time, then the account get locked out.

What are successfull techniques that could be used on the web interface
to avoid having a script run against it that would potentially lock out
15000 user accounts, and create a headache for the system administrators
who have to manually unlock each account?

Also assume the current user account names are known by everyone.  

Possible techniques we've thrown around:
1)  Allow each user to pick their own username instead of using a
standard (i.e. First 3 letters of first name + Full last name)

2) Create a set time-out period  for each account of  X (maybe an hour)