DEV Community: Sven Strittmatter

Credential Stuffing vs Password Spraying

Sven Strittmatter — Thu, 29 Oct 2020 17:53:39 +0000

At my employer we use Office 365. I'm not an Microsoft advocate. My friends and colleagues rather know me as Apple-Fanboy and BSD-Geek. But I have to admit that Office 365 works good enough. Even in these pandemic times when we work from home Teams and such serves very well.

As part of our security team we also encounter attacks against our user accounts. Maybe you read about that in the press: There are credential stuffing and password spray attacks going on this year against Office 365 accounts. Today I wondered what the concrete difference is between these two types of attacks. Until today I used the terms interchangeably: Its all a kind of brute force, right? No, it's not that easy.

Credential Stuffing

This is an attack where an adversary uses a known pair of username and password to gain access. Eg. there is a password leak from the site foobar.com: They stored username and password in plain text. Lot of users use the same username password across many sites. So one could try to use the username and password from foobar.com at Facebook, Twitter or whatever to gain access.

So credential stuffing uses a list of known username password combinations to brute-force against an authentication.

Password Spraying

In contrast this is an attack where the adversary only knows the username and tries a list of common or weak passwords with it. Eg. you know that the usernames at foobar.com are same as the email addresses and you can harvest some of them from the website. Then you use a list of commonly used or weak password (eg. test1234, password etc.) together wit the usernames to gain access.

So password spraying uses a list of known usernames in combination with commonly known and/or weak passwords to brute-force authentication.

First posted at https://blog.weltraumschaf.de/blog/Credential-Stuffing-vs-Password-Spraying/

AuthN vs AuthZ

Sven Strittmatter — Fri, 23 Oct 2020 10:44:56 +0000

When you do some "login stuff" nowadays you may stumbled upon the terms AuthN and AuthZ. Maybe you wondered what these "N" and "Z" means? Short answer:

AuthN stands for Authentication, and
AuthZ stands for Authorization.

That's easy right? We're done for this blog post 🙃

Authentication vs. Authorization

But what is the difference of these two terms? Is it not the same? Short answer: No, it isn't!

Authentication

Authentication is all about who you are. In the most simple form when you type a username and password somewhere. In a more complex scenario – eg. when you buy a TLS certificate – when you go to a notary showing your identity card.

So authentication is the process of verify that you are the person you are pretending to be.

Authorization

Authorization is all about what you are allowed to do. In the most simple form you are allowed to clone a Git repository and push into it, but you are not authorized to delete branches in that repository. Authorization must be granted by an entity which have more rights (is privileged) than you. Eg. when you want to buy a new laptop you request this to your boss and she authorizes this by granting or declining it.

So authorization is the process of verify what you are allowed to do.

Last Words

Authentication can be used without authorization but vice versa is not possible. To authorize someone or something – not only natural persons may be authenticated or authorized, but also entities like computers, servers, APIs, etc. – it is required to authenticate first to know who you grant or decline access (authorize). Eg. when you walk around in a large factory there may be restricted areas with a security guard protecting it. You must show him your corporate identity card for authentication. Then the guard looks up in his system if you are allowed to access that ares (authorization) and grants or declines that you go on.

First posted at https://blog.weltraumschaf.de/blog/AuthN-vs-AuthZ/

OAuth 2.0 Implicit Flow Considered Harmful

Sven Strittmatter — Thu, 08 Oct 2020 16:41:26 +0000

https://blog.weltraumschaf.de/blog/OAuth-Implicit-Flow-Considered-Harmful/

Improve Your Documentation With Russian Roulette

Sven Strittmatter — Mon, 21 Sep 2020 12:34:28 +0000

https://blog.weltraumschaf.de/blog/Improve-Your-Documentation-with-Russian-Roulette/

Semantic Versioning

Sven Strittmatter — Fri, 22 May 2020 10:08:09 +0000

Please use Semantic Versioning and please use it right!

https://blog.weltraumschaf.de/blog/Please-Use-Semantic-Versioning/

SemVer

Hardening Your SSHd With Ansible

Sven Strittmatter — Fri, 08 May 2020 12:34:48 +0000

I blogged about harding SSHd with Ansible to increase security of your server: https://blog.weltraumschaf.de/blog/Hardening-Your-SSHd-with-Ansible/