Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite
1

Say there is a line of business application which has username/password datatable in the DB. Personal email address is not stored, and usernames are assigned by an administrator. Someone gains access to the database, and finds out, among other things, mentioned user data.

Why would one be interested in passwords, when he has access to all the data in the database?

share|improve this question

2 Answers

up vote 5 down vote accepted

Users often reuse their password, so you can try those passwords on other databases or applications as well.

You can try and find out their personal email address through other ways than just the database (social engineering). From there you can get access to their paypal account, facebook, etc.

Anyway if you store your password unhashed in a database something is wrong.

share|improve this answer
1  
Yes, that is a constant theme I encountered while googling. User could be using the password for other sites/applications. I thought there could be some additional reasons, because, if the DB is already stolen, passwords are only one worry, far lesser than, say, more valuable business data. – joff Mar 19 '12 at 11:07
+1. Good answer. If the passwords are also stored in the database as plain text, there is the reputational risk also to consider. – James Youngman Mar 19 '12 at 12:36
2  
While this is true, it is not the main risk of password exposure. If someone reuses his password, then he's already spewing it all over the place, without your help. See e.g. xkcd.com/792. – AviD♦ Mar 19 '12 at 13:56
@AviD - posted xkcd.com/792 and then saw you beat me to it. – dr jimbob Mar 19 '12 at 16:21
Even if passwords are hashed, they're still extremely crackable. There's been passdumps on pastebin/pastie types of sites that was able to get 70-90% of within half an hour of cracking. Unsalted hashes + good dictionaries + mangling rulesets can make hash cracking ridiculously efficient even with a single computer. – Marcin Mar 20 '12 at 12:17
show 1 more comment
up vote 2 down vote

Perhaps the attacker was only able to download a read-only copy of the database.
So sure, she can see all the other secret data stored in the database, and compared to that the passwords may not have much value.
However, it is only by impersonating an actual user to the live system, that she would be able to affect changes - e.g. changing the balance in her account, inserting records, and performing any business functionality supported by the system (other than simply reading data). Depending on the system, there may even be other subsystems it talks to, and not just storing in the database. If that is the case, then even if the attacker is able to update the database, some of the external functionality may not be available without impersonation. And that's what you need the password for.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.