Re: username and Password sent as clear text strings

I never called it a password in clear text, I said it was a clear text string that contained a password. In my mind that is different then a clear text password.

Just my two shiney centavos --John

-------------- Original message ----------------------
From: "Matthew Zimmerman" <mzimmerman@xxxxxxxxx>
In my opinion, if you want to mitigate this, don't use passwords. Use
true challenge-response. Everything else proposed here is either
obfuscation or doesn't really work in a web application environment.
A VPN around a webserver only works if every user that needs access to
that webserver can also access the vpn.

This situation should NOT be described as a 'password in cleartext'.
If you call SSL encryption (when using a decent symmetric algorithm),
then this is not a cleartext issue... You've committed a
man-in-the-middle attack by being the client AND the
man-in-the-middle... That doesn't really get you anything. If you
control the client, you control the connection. In this case, you
told your client to trust a self-signed certificate with the name of
"WebScarab" when you went to "OtherSite.

Follow NIST SP 800-63 for more guidance --
http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-63--1

Matt Zimmerman

On Wed, May 14, 2008 at 6:39 AM, <jfvanmeter@xxxxxxxxxxx> wrote:
Hello everyone, and I know this might not be the most correct place to post
this questions, but I was hoping to get some feedback on what you think the
potential risk would be and how this this could be exploited.

I completed a security review of a web server, that creates a SSL connection
between the cleint and the server. Using WebScarab, I could see that the
username and password are sent as clear text strings. The log in to the server
requires a administrative account.

Do you think there is a large amount of risk, in sending the username and
password as a clear text string, since the pipe is encrypted? I was thinking
that a man-in-the-middle or sometype of session hijacking attack could allow
the account to be compromised.

I'm working on completing the report for my client and was hoping to get some
feedback from everyone so I could pose this to them correcly.

Thank you in advance --John

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------



------------------------------------------------------------------------
This list is sponsored by: Cenzic

Top 5 Common Mistakes
in Securing Web Applications
Find out now! Get Webinar Recording and PPT Slides

www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------



------------------------------------------------------------------------
This list is sponsored by: Cenzic

Top 5 Common Mistakes
in Securing Web Applications
Find out now! Get Webinar Recording and PPT Slides

www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------

Relevant Pages

  • Each client gets the same port number
    ... This class creates a server socket that will ... For each new connection request from client ... */ private String calculate{String result = null; ...
    (comp.lang.java.help)
  • Re: Applet Consideration
    ... > the client applet to connect to the server. ... everything is sent as String. ... >> I made it so the client has absolutely no knowledge that the db exists. ... Each thread must be initialized by a login. ...
    (comp.lang.java.databases)
  • Re: Applet Consideration
    ... the client applet to connect to the server. ... My computer(the server) is behind a router ... > i.e. boolean login(String domain, String user, String pass) ...
    (comp.lang.java.databases)
  • Re: Still Need desperate help to start with ASP NET - simplified problems - HELP!!
    ... Not to IIS. ... A client uses IE to talk with a server. ... String) As String ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: socketServer questions
    ... >> I'm trying to keep script kiddies from tampering with a socket server. ... >> want the server to only load a valid or verified string into its log ... > If the clients can keep a secret key secure, ... > and the client would send #i as part of the string. ...
    (comp.lang.python)