Project SimpleProject Type: software

Project Simple

Uploaded image for project: 'Project Simple'
  1. Project Simple
  2. ST-201

INSECURE PASSWORD STORAGE

    Details

    • Type: Enhancement
    • Status: Closed
    • Priority: Medium
    • Resolution: Done
    • Component/s: BenAdmin
    • Labels:
    • Module:
      BenAdmin - Security
    • Reported by:
      Support
    • Item State:
      LB QA - LB Deployed
    • Issue Importance:
      Must Have

      Description

      Impact
      Encrypting passwords is an insecure method of storing passwords. By storing the key to these passwords, WORKTERRA has direct access to user passwords. If a malicious user with elevated access or a malicious employee wanted to view user passwords, that individual could do so by using the encryption key to decrypt passwords. The ability to decrypt passwords adds significant risk to the users of WORKTERRA's application in the event of a data compromise.

      Verification and Attack Information
      Praetorian confirmed that passwords were encrypted using AES-256 through an interview with the application’s developers.

      Recommendation
      Use a Password Based Key Derivation Function (PBKDF) to store hashes of passwords as an alternative to storing in encrypted passwords. Praetorian recommends using one of the following algorithms (in order of preference): Scrypt, Bcrypt, or PBKDF2.

      References
      https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet
      https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2015/march/enough-with-the-salts-updates-on-secure-password-schemes/
      http://codahale.com/how-to-safely-store-a-password/

        Attachments

          Activity

          Ascending order - Click to sort in descending order
          Hide
          Permalink
          vikas.pawar Vikas Pawar (Inactive) added a comment -

          Changed existing encryption algorithm to SCrypt hashing algorithm

          Created migration utility to migrate existing passwords.
          Checked in LB.

          Show
          vikas.pawar Vikas Pawar (Inactive) added a comment - Changed existing encryption algorithm to SCrypt hashing algorithm Created migration utility to migrate existing passwords. Checked in LB.
          Hide
          Permalink
          rakeshr Rakesh Roy (Inactive) added a comment -

          Zeeshan Chishty Hrishikesh DeshpandeDeepali Tidke
          Please check the scope of this and plan your testing accordingly.
          For any help approach developer to understand what functionality can be impacted.

          Show
          rakeshr Rakesh Roy (Inactive) added a comment - Zeeshan Chishty Hrishikesh Deshpande Deepali Tidke Please check the scope of this and plan your testing accordingly. For any help approach developer to understand what functionality can be impacted.
          Hide
          Permalink
          rakeshr Rakesh Roy (Inactive) added a comment -

          Vikas Pawar Please do not change status as Local testing before it gets deployed.

          Show
          rakeshr Rakesh Roy (Inactive) added a comment - Vikas Pawar Please do not change status as Local testing before it gets deployed.
          Hide
          Permalink
          vikas.pawar Vikas Pawar (Inactive) added a comment -

          Rakesh Roy This change is deployed on LB.

          Show
          vikas.pawar Vikas Pawar (Inactive) added a comment - Rakesh Roy This change is deployed on LB.
          Hide
          Permalink
          Zeeshan.Chishty Zeeshan Chishty (Inactive) added a comment -

          Hi Rakesh,

          As per my understanding we only need to make sure that passwords are now getting stored using scrypt algorithm. We need sample of values of the stored passwords and try to crack them. Please correct me if I am wrong.

          Show
          Zeeshan.Chishty Zeeshan Chishty (Inactive) added a comment - Hi Rakesh, As per my understanding we only need to make sure that passwords are now getting stored using scrypt algorithm. We need sample of values of the stored passwords and try to crack them. Please correct me if I am wrong.
          Hide
          Permalink
          rakeshr Rakesh Roy (Inactive) added a comment -

          Vikas Pawar Please update Zeeshan's query.
          Venkatesh PujariZeeshan ChishtyVijayendra Shinde

          Show
          rakeshr Rakesh Roy (Inactive) added a comment - Vikas Pawar Please update Zeeshan's query. Venkatesh Pujari Zeeshan Chishty Vijayendra Shinde
          Hide
          Permalink
          vikas.pawar Vikas Pawar (Inactive) added a comment -

          Zeeshan Chishty All the user passwords are stored using Scrypt Algorithm.
          Rakesh Roy Already i had shared password with Zeeshan Chishty.
          Zeeshan Chishty Please provide your updates on this.

          Show
          vikas.pawar Vikas Pawar (Inactive) added a comment - Zeeshan Chishty All the user passwords are stored using Scrypt Algorithm. Rakesh Roy Already i had shared password with Zeeshan Chishty . Zeeshan Chishty Please provide your updates on this.
          Hide
          Permalink
          Zeeshan.Chishty Zeeshan Chishty (Inactive) added a comment -

          I tried to decry-pt the password but was not able to do that. We also verified that HASH value generated is different always for the same input..

          Show
          Zeeshan.Chishty Zeeshan Chishty (Inactive) added a comment - I tried to decry-pt the password but was not able to do that. We also verified that HASH value generated is different always for the same input..
          Hide
          Permalink
          rakeshr Rakesh Roy (Inactive) added a comment -

          Is this ready for stage deployment, Zeeshan Chishty

          Show
          rakeshr Rakesh Roy (Inactive) added a comment - Is this ready for stage deployment, Zeeshan Chishty
          Hide
          Permalink
          Zeeshan.Chishty Zeeshan Chishty (Inactive) added a comment -

          Rakesh Roy Yes

          Show
          Zeeshan.Chishty Zeeshan Chishty (Inactive) added a comment - Rakesh Roy Yes
          Hide
          Permalink
          venkatesh.pujari Venkatesh Pujari (Inactive) added a comment -

          Hi Vikas,

          Please find my comments below:-
          1] Verify all logins by adding and deleting all role users and verifying their logins.
          2] Verified ADD/Update/Delete for all users.
          3] Verified forgot password with CA,Partner and Employee login and observed that Employee login forgot password is not working as expected.

          Please look into this.

          Thanks,
          Venkatesh

          Show
          venkatesh.pujari Venkatesh Pujari (Inactive) added a comment - Hi Vikas, Please find my comments below:- 1] Verify all logins by adding and deleting all role users and verifying their logins. 2] Verified ADD/Update/Delete for all users. 3] Verified forgot password with CA,Partner and Employee login and observed that Employee login forgot password is not working as expected. Please look into this. Thanks, Venkatesh
          Hide
          Permalink
          vikas.pawar Vikas Pawar (Inactive) added a comment -

          Hi Venkatesh Pujari,
          This issue was because of same company was given to multiple databases.
          I have renamed one in-active company name. Now you can test on it.

          Show
          vikas.pawar Vikas Pawar (Inactive) added a comment - Hi Venkatesh Pujari , This issue was because of same company was given to multiple databases. I have renamed one in-active company name. Now you can test on it.
          Hide
          Permalink
          venkatesh.pujari Venkatesh Pujari (Inactive) added a comment -

          Hi Vikas,

          I have verified forgot password for Employee login on CST for Hspl company on stage but this is not working as per implementation please look into this and assign this ticket to me once fixed.

          Thanks,
          Venkatesh

          Show
          venkatesh.pujari Venkatesh Pujari (Inactive) added a comment - Hi Vikas, I have verified forgot password for Employee login on CST for Hspl company on stage but this is not working as per implementation please look into this and assign this ticket to me once fixed. Thanks, Venkatesh
          Hide
          Permalink
          vikas.pawar Vikas Pawar (Inactive) added a comment -

          Hi Venkatesh,
          TokenDateTimeStamp column was missing from Users table on stage. Added Column in users table. Please check now.

          Show
          vikas.pawar Vikas Pawar (Inactive) added a comment - Hi Venkatesh, TokenDateTimeStamp column was missing from Users table on stage. Added Column in users table. Please check now.
          Hide
          Permalink
          venkatesh.pujari Venkatesh Pujari (Inactive) added a comment -

          Hi Vikas,

          I have verified forgot password for Employee login on City of Denton for Hspl company on stage and it is working as per implementation.

          Ready for Production.

          Thanks,
          Venkatesh

          Show
          venkatesh.pujari Venkatesh Pujari (Inactive) added a comment - Hi Vikas, I have verified forgot password for Employee login on City of Denton for Hspl company on stage and it is working as per implementation. Ready for Production. Thanks, Venkatesh
          Hide
          Permalink
          venkatesh.pujari Venkatesh Pujari (Inactive) added a comment -

          Hi Vikas,

          Please find my comments below:-
          1] Verify all logins by adding and deleting all role users and verifying their logins.
          2] Verified ADD/Update/Delete for all users.
          3] Verified forgot password with CA,Partner and Employee login.

          Working fine as expected so closing the ticket.

          Show
          venkatesh.pujari Venkatesh Pujari (Inactive) added a comment - Hi Vikas, Please find my comments below:- 1] Verify all logins by adding and deleting all role users and verifying their logins. 2] Verified ADD/Update/Delete for all users. 3] Verified forgot password with CA,Partner and Employee login. Working fine as expected so closing the ticket.

            People

            Assignee:
            venkatesh.pujari Venkatesh Pujari (Inactive)
            Reporter:
            vijayendra Vijayendra Shinde (Inactive)
            Developer:
            Vikas Pawar (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:

                Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0h
                0h
                Logged:
                Time Spent - 0.75h
                0.75h