Medium Impact
Encrypting passwords is an insecure method of storing passwords. By storing the key to these passwords, WORKTERRA has direct access to user passwords. If a malicious user with elevated access or a malicious employee wanted to view user passwords, that individual could do so by using the encryption key to decrypt passwords. The ability to decrypt passwords adds significant risk to the users of WORKTERRA's application in the event of a data compromise.
Verification and Attack Information
Praetorian confirmed that passwords were encrypted using AES-256 through an interview with the application’s developers.
Recommendation
Use a Password Based Key Derivation Function (PBKDF) to store hashes of passwords as an alternative to storing in encrypted passwords. Praetorian recommends using one of the following algorithms (in order of preference): Scrypt, Bcrypt, or PBKDF2.
References
https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet
https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2015/march/enough-with-the-salts-updates-on-secure-password-schemes/
http://codahale.com/how-to-safely-store-a-password/
| Field | Original Value | New Value |
|---|---|---|
| Status | New Request [ 10029 ] | Pending for Approval [ 10002 ] |
| Status | Pending for Approval [ 10002 ] | Approved for Development [ 10003 ] |
| Status | Approved for Development [ 10003 ] | In Development [ 10007 ] |
| Assignee | Vikas Pawar [ vikas.pawar ] |
| Labels | Security |
| Status | In Development [ 10007 ] | Local Testing [ 10200 ] |
| Assignee | Vikas Pawar [ vikas.pawar ] | Rakesh Roy [ rakeshr ] |
| Assignee | Rakesh Roy [ rakeshr ] | Zeeshan Chishty [ zeeshan.chishty ] |
Zeeshan Chishty (Inactive)
made changes -
| Assignee | Zeeshan Chishty [ zeeshan.chishty ] | Deepali Tidke [ deepalit ] |
| Assignee | Deepali Tidke [ deepalit ] | Venkatesh Pujari [ venkatesh.pujari ] |
| Status | Local Testing [ 10200 ] | Pending for Stage Approval [ 10300 ] |
| Item State | Parent values: Development(10200)Level 1 values: In Progress(10206) | Parent values: LB QA(10201)Level 1 values: Ready for Stage(10213) |
| Developer | Vikas Pawar [ vikas.pawar ] |
| Item State | Parent values: LB QA(10201)Level 1 values: Ready for Stage(10213) | Parent values: Stage QA(10202)Level 1 values: Stage Deployed(11602) |
| Status | Pending for Stage Approval [ 10300 ] | Approved for Stage [ 10030 ] |
| Status | Approved for Stage [ 10030 ] | Stage Testing [ 10201 ] |
| Status | Stage Testing [ 10201 ] | Reopen in Stage [ 10023 ] |
| Item State | Parent values: Stage QA(10202)Level 1 values: Stage Deployed(11602) | Parent values: Stage QA(10202)Level 1 values: Re-open(10216) |
| Assignee | Venkatesh Pujari [ venkatesh.pujari ] | Vikas Pawar [ vikas.pawar ] |
| Assignee | Vikas Pawar [ vikas.pawar ] | Venkatesh Pujari [ venkatesh.pujari ] |
| Item State | Parent values: Stage QA(10202)Level 1 values: Re-open(10216) | Parent values: Stage QA(10202)Level 1 values: In Testing(10214) |
| Item State | Parent values: Stage QA(10202)Level 1 values: In Testing(10214) | Parent values: Stage QA(10202)Level 1 values: Re-open(10216) |
| Assignee | Venkatesh Pujari [ venkatesh.pujari ] | Vikas Pawar [ vikas.pawar ] |
| Assignee | Vikas Pawar [ vikas.pawar ] | Venkatesh Pujari [ venkatesh.pujari ] |
| Status | Reopen in Stage [ 10023 ] | In Development [ 10007 ] |
| Status | In Development [ 10007 ] | Local Testing [ 10200 ] |
| Status | Local Testing [ 10200 ] | Pending for Stage Approval [ 10300 ] |
| Status | Pending for Stage Approval [ 10300 ] | Approved for Stage [ 10030 ] |
| Status | Approved for Stage [ 10030 ] | Stage Testing [ 10201 ] |
| Item State | Parent values: Stage QA(10202)Level 1 values: Re-open(10216) | Parent values: Stage QA(10202)Level 1 values: Ready for Production(10217) |
| Item State | Parent values: Stage QA(10202)Level 1 values: Ready for Production(10217) | Parent values: Stage QA(10202)Level 1 values: Production Deployment on Hold(10224) |
| Item State | Parent values: Stage QA(10202)Level 1 values: Production Deployment on Hold(10224) | Parent values: Production QA(10203)Level 1 values: Production Deployed(10221) |
| Status | Stage Testing [ 10201 ] | Pending for Production Approval [ 10301 ] |
| Status | Pending for Production Approval [ 10301 ] | Approved for production [ 10034 ] |
| Status | Approved for production [ 10034 ] | Production Testing [ 10202 ] |
| Resolution | Done [ 10000 ] | |
| Status | Production Testing [ 10202 ] | Production Complete [ 10028 ] |
| Item State | Parent values: Production QA(10203)Level 1 values: Production Deployed(10221) | Parent values: Production Complete(10222)Level 1 values: Closed(10223) |
| Resolution | Done [ 10000 ] | Fixed [ 1 ] |
| Status | Production Complete [ 10028 ] | Closed [ 6 ] |
| Remaining Estimate | 0h [ 0 ] | |
| Time Spent | 0.75h [ 2700 ] | |
| Worklog Id | 45207 [ 45207 ] |
Khandu Kshirsagar (Inactive)
made changes -
| Item State | Parent values: Production Complete(10222)Level 1 values: Closed(10223) | Parent values: LB QA(10201)Level 1 values: LB Deployed(11600) |
