CAPEC-70
Try Common or Default Usernames and Passwords
2014-06-23
00h00 +00:00
00h00 +00:00
指定 CAPEC 提醒
掌握特定 CAPEC 的任何變更。
CAPEC 描述
An adversary may try certain common or default usernames and passwords to gain access into the system and perform unauthorized actions. An adversary may try an intelligent brute force using empty passwords, known vendor default credentials, as well as a dictionary of common usernames and passwords. Many vendor products come preconfigured with default (and thus well-known) usernames and passwords that should be deleted prior to usage in a production environment. It is a common mistake to forget to remove these default login credentials. Another problem is that users would pick very simple (common) passwords (e.g. "secret" or "password") that make it easier for the attacker to gain access to the system compared to using a brute force attack or even a dictionary attack using a full dictionary.
CAPEC 資訊
前置條件
The system uses one factor password based authentication.The adversary has the means to interact with the system.所需技能
An adversary just needs to gain access to common default usernames/passwords specific to the technologies used by the system. Additionally, a brute force attack leveraging common passwords can be easily realized if the user name is known.所需資源
Technology or vendor specific list of default usernames and passwords.緩解措施
Delete all default account credentials that may be put in by the product vendor.Implement a password throttling mechanism. This mechanism should take into account both the IP address and the log in name of the user.
Put together a strong password policy and make sure that all user created passwords comply with it. Alternatively automatically generate strong passwords for users.
Passwords need to be recycled to prevent aging, that is every once in a while a new password must be chosen.
相關弱點
| 弱點名稱 | |
|---|---|
CWE-521 |
Weak Password Requirements The product does not require that users should have strong passwords. |
CWE-262 |
Not Using Password Aging The product does not have a mechanism in place for managing password aging. |
CWE-263 |
Password Aging with Long Expiration The product supports password aging, but the expiration period is too long. |
CWE-798 |
Use of Hard-coded Credentials The product contains hard-coded credentials, such as a password or cryptographic key. |
CWE-654 |
Reliance on a Single Factor in a Security Decision A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality. |
CWE-308 |
Use of Single-factor Authentication The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor. |
CWE-309 |
Use of Password System for Primary Authentication The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism. |
參考資料
REF-572
Corporate IoT – a path to intrusionhttps://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion
REF-574
Risks of Default Passwords on the Internethttps://www.us-cert.gov/ncas/alerts/TA13-175A
REF-596
OWASP Web Security Testing Guidehttps://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account.html
REF-597
OWASP Web Security Testing Guidehttps://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/04-Authentication_Testing/02-Testing_for_Default_Credentials.html
提交
| 名稱 | 機構 | 日期 | 發布日期 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Attack_Prerequisites, Attacker_Skills_or_Knowledge_Required, Description Summary, Examples-Instances | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances, References, Related_Attack_Patterns, Related_Weaknesses, Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated References, Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings |
