64

At my job, to be able to view my paychecks, vacation hours and HR data on myself I need to log into a 3rd party website.

I'm by no means a security expert or expert programmer but I could tell (simply by trying) that I could continue to try incorrect passwords without being locked out. (brute force: viable)

After logging in I was forced to select 3 pre-determined security questions in the case of a password reset (out of a total of 8!) such as my first car's licence plate (never owned a car 3/7), my spouse's 2nd name (don't have a spouse 3/6), 2nd name of my first kid (don't have kids 3/5), birthdate, name of my highschool, favorite pet, favorite film or favorite piece of music.

Most these things you can simply get from my facebook, (which, I should note, has not been updated for years!) again showing a distinct lack of understanding in basic security practices.

I also get the feeling, from looking at the site through the developer tools they use incredibly outdated software 

A JavaScript implementation of the RSA Data Security, Inc. MD5 Message
* Digest Algorithm, as defined in RFC 1321.
* Version 2.1 Copyright (C) Paul Johnston 1999 - 2002.

I reported this through my company but my superiors don't appear all that interested.

How would I go about:

A. Finding out if this site is really as insecure as I think it is?

B. if true: communicating this in an appropriate manner to the company itself (preferably in an anonymous fashion)

200_success
  • 2,144
  • 2
  • 15
  • 20
A. Nony-Mous
  • 615
  • 1
  • 5
  • 4
  • 98
    A mitigation for security questions is to have randomly-generated passwords from a password manager as security "answers". That way, an adversary has no way to use OSINT against you. The rest of your question should be moved to https://workplace.stackexchange.com/ TBH – SeeYouInDisneyland Nov 15 '18 at 10:56
  • 23
    Your analysis may be incorrect. Doesn't hassle you after a few wrong attempts doesn't imply it's vulnerable to brute force, we have other better more user friendly ways. Captchas, rate limiting etc. – Nathan Cooper Nov 15 '18 at 14:16
  • 17
    MD5 is pretty straightforward, so it's not surprising that code built to generate an MD5 hash wouldn't have changed much since being written (and it was released in 1992). *Using* MD5 is potentially problematic, but it's possible to use it in safe, innocuous ways. One hopes the site's not doing password hashing client-side, for example. – ceejayoz Nov 15 '18 at 14:23
  • 151
    That's my MD5 script they're using! – paj28 Nov 15 '18 at 15:43
  • 15
    The fact that you can keep entering passwords doesn't mean there's no brute-force protection. It is possible (and actually highly sensible!) to simply incur an ever bigger delay with every incorrect attempt. This makes a true brute force infeasible without locking somebody out who simply keeps mistyping their password. – leftaroundabout Nov 15 '18 at 16:06
  • 5
    @leftaroundabout Or silently lockout like refusing to reveal the case that a valid username has been paired with an invalid password. – Mooseman Nov 15 '18 at 20:51
  • 4
    @Criggie One should also note that honest answers to questions like "favourtite movie" may well change between the initial answer and that case of emergency retrieval in five years – Hagen von Eitzen Nov 15 '18 at 23:36
  • 3
    Context is everything. Using MD5 to detect accidental data corruption during a file transfert is just as safe as using SHA1, or any more modern, stronger, "safer" hash function. Using a stronger, slower hash function, if the hash value can be intercepted and manipulated, gives only an illusion of security. – curiousguy Nov 16 '18 at 00:21
  • 1
    @SeeYouInDisneyland but that only protects a single person. The fact that the platform is vulnerable to OSINT (at least) remains and anybody *else* could have their account hijacked. Say, *managers* - the same people who showed no interest in security and who are probably better targets anyway. – VLAZ Nov 16 '18 at 07:05
  • 2
    What actually happens when you provide the answer to the security question? Those questions often work by sending you a password reset token by E-Mail, which makes it essentially two-factor authentication, because you don't just need to know the answer, you also need to have access to the E-Mails. --- Also, how can the website be accessed? Is it even possible to access it from outside the company network? If not, security becomes a lesser concern, because company employees are generally (mostly) trusted and it becomes an issue of securing the company network. – Morfildur Nov 16 '18 at 10:01
  • 2
    Maybe keeping the paychecks secret is not that much of a big deal? – gerrit Nov 16 '18 at 15:49
  • 1
    Does the site use HTTPS? – jpmc26 Nov 17 '18 at 05:57
  • 3
    > I give any sort of care about security > all my details are on Facebook – Harper - Reinstate Monica Nov 18 '18 at 16:14
  • My understanding is that you're not obliged to provide answers that are true, just answers that are memorable. That said, I was truly fond of my first pet, @ki55%%h!nrfZZ – Strawberry Nov 19 '18 at 11:49

6 Answers6

105

To start with the easy bit: you do not have to put real information as the answers to the questions. Random strings work best if you are really paranoid and store them in a password manager just like a password.

The rest (no brute force protection, potentially outdated software) is a shame, but there is nothing that you can do, from a security perspective. I would raise the issue with HR/Payroll and ask them to investigate. If you are in Europe, then you can also talk to your DPO to suggest that their "Data Processor" has troubling account security practices that need to be investigated.

Otherwise, this is more of an internal office politics issue.

schroeder
  • 123,438
  • 55
  • 284
  • 319
  • 4
    There is one thing you can do about the lack of protection against brute forcing passwords: You can use a strong password. – kasperd Nov 15 '18 at 14:20
  • 157
    "you do not have to put real information" Are you trying to tell me my First Pets Name isn't LRnq98FHk63FbrdYbJHvMRRe? I miss LRnq... – WernerCD Nov 15 '18 at 14:52
  • 1
    @WernerCD now you're reminding me about how little LRnq98FHk63FbrdYbJHvMRRe had to be sent away because he just wouldn't behave calmly around people, and I am sad :( – Jon Hanna Nov 15 '18 at 17:57
  • 137
    Or you could actually name your pets and kids with a password manger. – Rad80 Nov 15 '18 at 19:23
  • 56
    @Rad80 but then people would know the answer to your security questions. You should really name your pets and kids with a password manager, but put in real/normal names in the security questions. – At0mic Nov 15 '18 at 19:35
  • 32
    The problem with this approach is of course: You will need to supply the security answers only in situations where you have lost the password itself. The only way I can imagine how you lost it is by corrupting your password manager (or by not habing access to it from far away) - in which case you won't have access to your random pet names stored in the same password manager, either. – Hagen von Eitzen Nov 15 '18 at 23:39
  • 2
    @HagenvonEitzen in which case you call their support and have them sort it out, the company is a paying customer and I'd have no quarrels whatsoever to wasting their time if their unsecure practices are the reason. – DonQuiKong Nov 16 '18 at 07:40
  • 5
    @HagenvonEitzen you missed a key point and your assumption is not correct: A) in the situation, the user is forced to enter something, and B) secret questions can be used for verification processes beyond just password resets like getting help over the phone. – schroeder Nov 16 '18 at 11:53
  • 6
    I did specify my first pet's name as "DvYdOAsEf4D5xFG6nyN3j" (and similar answers to other questions) in the security question of a company account. It was good fun when they called my manager for verification and he had to answer the 3 security questions over the phone :-D – Weirdo Nov 16 '18 at 12:06
  • 1
    @HagenvonEitzen Maybe you have enough backups of your password manager data that you aren't going to lose it. And your only concern about the security questions is that somebody else might abuse them. Or the site decides that they aren't going to trust you are the right person even though you did enter the correct password, and they ask you for a security question as well - just to be sure. – kasperd Nov 16 '18 at 12:45
  • 19
    @IronCraftMan you never share true names as that allows the use of magic directly on the named item. All dragons, daemons and such already practise this secuirty measure. – TafT Nov 16 '18 at 13:15
  • 4
    @HagenvonEitzen That's true but “neutralizing” run-of-the-mill “security questions“ is a net positive from a security perspective. You're effectively trading the convenience of an easy password reset for additional security. You might just as well forget the random strings and focus on a good backup strategy for your passwords. – Relaxed Nov 16 '18 at 16:51
  • @kasperd I had a certain bank (a major Canadian bank that may or may not be based out of Montreal) that forces me to use a 6 character password for my online banking. I laughed out loud when the lady on the phone told me that. I thought it was a joke. She also didn't understand why it was bad, apparently, it's convenient for people to make it so short. Apparently they're "upgrading soon" whatever that means. – corsiKa Nov 17 '18 at 04:04
  • 1
    @Rad80 Little Bobby Tables, we call him. – Paul D. Waite Nov 18 '18 at 20:58
  • @HagenvonEitzen In this case I would consider not saving the reset answers - and use the HR team to reset it for you; which they will certainly be able to do. This may be less convenient for the HR team, but so what? – UKMonkey Nov 19 '18 at 12:46
  • I make sure to use randomly generated words (from 1Password, for reference), so that if I'm on the phone with someone, I'll be able to pronounce it. – Calion Mar 23 '19 at 01:38
29

To me this says you haven't investigated enough to confidently say it's insecure. You haven't shown any particular direct exploit nor really dug into their system (in a non-hacking, poking around kind of way). Your superiors may not be interested because of the lacking direct evidence of this.

As an example, my work uses a 3rd party site for scheduling vacations, I found it allows me to "recover" my password by sending my exact password back in plain-text via email, that is a direct evidence of an issue that I can report. Likewise, a site used for some IT services (SIP Trunk) had an issue where I could change the ID's in the URL and (to my surprise) view other people's account info, again, another direct line of evidence. Right now, you just have suspicions, and not obvious ones.

As an aside, all security questions for resetting passwords are insecure, as they rely on common information. As others have suggested, you can put fake answers in here (that you can still remember) or entirely randomly generated strings. You can think of the security questions as a "String" to "String" security challenge in the most generic sense.

schroeder
  • 123,438
  • 55
  • 284
  • 319
Jarrod Christman
  • 612
  • 4
  • 8
  • 10
    By the way, any down votes are welcome, as long as an explanation is given. We're all only posting here to help, so helping the help get better at helping is helpful ;-) – Jarrod Christman Nov 15 '18 at 15:23
  • 11
    You are confusing hazards with exploits. The hazards are clear and understandable. Also, you have not answered the question (you reiterated the question). "How would I go about: A. Finding out if this site is really as insecure as I think it is?" Your answer says, "you need to find out if the site is insecure" – schroeder Nov 15 '18 at 16:36
  • 2
    i didn't downvote, but `login system is not protected against bruteforce / dictionary attacks` is a very real direct problem. i would also check if the system is vulnerable against timing attacks (which can massively speed up a bruteforce attack), but that's just me. – user1067003 Nov 16 '18 at 00:05
  • It's hard to decide which is worse: them using MD5, them rolling their own implementation of the MD5 algorithm, or them using MD5 client side. Anyone one of those is a sure sign of poor security practices. – Conor Mancone Nov 16 '18 at 01:25
  • 8
    Many employers will be greatly annoyed if they discover you pen-testing their systems without advance knowledge and permission, and some might even try to bust you for violating hacking laws. Of course, if you ask "Can I spend my working hours on pen-testing this system I'm not responsible for?" the answer may well be no. – Kevin Nov 16 '18 at 02:27
  • User1067003, I would agree, if that was confidently known. When I meant is not a pen-test of their system, but a bit more prodding around. He is making the assumption it doesn't protect against bruteforce, but it may, just through different methods that are not as visible or the threshold is too high for him to tell from his quick look. Most of his worries, to me, are suspicions without enough information to say with confidence to his boss that the platform is insecure. – Jarrod Christman Nov 16 '18 at 14:54
  • 1
    Though, I'd agree, the line of poking around versus pen-testing is a very thin and fine one. I would relegate my poking around to normal user behavior and infer what I could, anything outside of normal user behavior you start getting questionable. Though, this is highly a matter of opinion, so I probably shouldn't recommend that. – Jarrod Christman Nov 16 '18 at 14:56
  • 1
    Schroeder, fair enough about the conflating of hazards and exploits. Though, to me a hazard isn't a hazard until I know and understand how it's being used. For example, MD5 is still useful (and quick) for certain uses, the use of it isn't inherently a hazard. I suppose my reply to his answer is to be more cautious about such assumptions. – Jarrod Christman Nov 16 '18 at 15:02
6

How would I go about:

A. Finding out if this site is really as insecure as I think it is?

You really cannot, unless you witness a concrete, exploitable problem. That's what infosec companies do, they try to actively break systems (with consent of the owners). They know many procedures and techniques to systematically take such an application appart, from simple things like using HTTP instead of HTTPS, insecure usage of cookies, XSS, SQL injection, but also other stuff like IDs being obviously simply counted up (which means you can just try them out sequentially), stuff being only checked on the browser (easily forged), and so on and so forth.

They also can combine blackbox- with whitebox-approaches (i.e., just looking from the outside, like any hacker/cracker would do, or actually studying the source code, entering the servers with provided accounts, and so on).

You could do all that yourself, but as you are asking, you obviously don't really know how. But the main problem is that if you did that, without first getting consent, you'd be at least in gray territory, if not outright breaking law.

B. if true: communicating this in an appropriate manner to the company itself (preferably in an anonymous fashion)

You cannot (anonymously, at least). If there is a dedicated CISO, he would be your first line of attack; but aside from that, especially in smaller firms, there is little you can do if your management just shrugs it off.

I guess there may be specific circumstances in which some government agency might be interested - for example if your company works for the government in an area which has strict security requirements; then obviously you might try to get an anonymous message to somewhere, but why would they care about your HR information...

But in general, for arbitrary companies, the saying "There's no fate but what we make for ourselves" would apply.

Community
  • 1
AnoE
  • 2,370
  • 1
  • 8
  • 12
1

If I had to guess, I'd bet the service is also resilient to brute force attacks, by simple virtue of being under-provisioned to handle the load involved. Go too fast with the guesses, and the server will fall over, alerting admins to what's going on. Go too slow, and you're not guessing fast enough to expect success in a reasonable period of time.

Add this to the suggestion by others to use false information, and the service isn't vulnerable at all if you're careful... least, not in ways reported so far. Note I said, "If". It does seem like an unfortunate design that, as you alluded, doesn't build confidence in what else might be behind the scenes.

I wouldn't attempt to actually test anything further myself, but if this is a product that is used by many other companies, you might try to put a bug in the ear of an actual security researches, who will know how to test it in an ethical way and be better prepared to deal with any legal fallout. If you're the only technically-minded person in your area at work, you might want to also alert co-workers for how to use the service "safely".

Joel Coehoorn
  • 2,116
  • 1
  • 13
  • 14
1

I think you're right - it sounds like, probably, the site is potentially pretty insecure. Those are some red flags, and the whole thing sounds a bit smelly. MD5 is widely considered cryptographically insecure.

That being said, the question of "what do I do?" is one that plagues a lot of security-related scenarios. There's a cost and a benefit to any action you take, and the right choice of action depends heavily on your environment and the nuances of your individual scenario. What kind of industry do you work in? How valuable is the information you're storing on the system? Perhaps most importantly, how receptive is your company to changing security practices?

These are all the relevant questions for you to answer, and ones which none of us here on The Internet™ are able to help with. In every question of how to handle a situation involving insecure practices, knowing the subtleties of a corporate environment - individuals' work histories, the nature of their company connections, the level of risk of souring relationships - defines what to do next.

What I'm trying to get at is, it seems to me like none of us are really qualified to answer this for you. There's an infinite array of potential options, and the best course of action truly depends on your situation at a level of detail that's not really conveyable here.

Good luck!

securityOrange
  • 913
  • 4
  • 12
-2

If you are an IT professional you can read the ACM Code of Ethics, which is the most comprehensive ethics code in IT today.

Section 1.2 says: "A computing professional has an additional obligation to report any signs of system risks that might result in harm. If leaders do not act to curtail or mitigate such risks, it may be necessary to "blow the whistle" to reduce potential harm. However, capricious or misguided reporting of risks can itself be harmful. Before reporting risks, a computing professional should carefully assess relevant aspects of the situation."

papajony
  • 454
  • 2
  • 8
  • 2
    Be very careful to understand what rights a whistleblower in your country/state has before you make that call. You may perceive what your employer is doing as immoral, but whistleblowing is often an illegal breach of contract unless you can prove your employer is doing something illegal themselves. Shitty security is not illegal in most cases unless you are handling data that is protected under HIPPA, PCI, GDPR, or some other similar regulation. Employers actually have very little government oversight regarding how they store employee information, at least in the USA. – Nosajimiki Nov 16 '18 at 21:20
  • Well, ACM is the biggest global IT organization, and this Code of Ethics has emerged after a lot of discussions and objections from members worldwide. If you abide to the code as an IT professional, it is an ethical guideline. What you will do is of course something entirely personal. Knowing something is wrong and not doing anything is the root of evil in our society. – papajony Nov 17 '18 at 06:56
  • How does this answer the questions asked? – reinierpost Nov 19 '18 at 12:31