Have there been any attacks (or can you think of a potential attack) that hinged on being able to figure out if a user exists in a system?

For example, in a web app there is a "Reset password" page where you enter an email address (which acts as the login name, which in combination with a password, grants you access). If you enter an email that is not in the system, it will tell you the user does not exist. If you enter an email that is in the system, it will give you an "email sent" message.

This seems to me to be a case where the less you can reveal, the better, but I also can't really think of a way in which it would introduce a vulnerability but it is inconvenient to not give the user more info.

  • Well, you can always "attack" the registration form... – user69874 Mar 17 '17 at 6:39

There are a few ways this could be an issue:

  • Considering some of the fallout of the Ashley Madison hack, being able to confirm whether or not a person has an account on a given site can be of value. In the case of this hack (per the Wikipedia article):

    Following the hack, communities of internet vigilantes began combing through to find famous individuals, who they planned to publicly humiliate.

  • On a similar note, attacks like that on human rights activists, or even watering hole attacks can be better targeted if you are able to confirm (or not) that they have accounts.

  • Phishing (and in specific, spear/whale phishing) can be made more effective if you can identify a good source to spoof. In that sense, if you can confirm a user has an account on a given site, then you are able to increase your chance of successful compromise (tangentially related).

Possibly not what you had in mind, but I would also recommend you consider the methodology Brian Krebs uses in his investigations: he has been able to draw conclusive evidence about criminal hacking based on being able to tie people to online handles. This isn't an 'attack', but it can result in DoS'ing individuals for some time.

I suspect the case most relevant to your question is being able to confirm whether a site is worth compromising in order to get to its users.

Notably, I suspect that considering that particular vector might lead to some specific design considerations, such as having your 'Reset Password' return a message akin to "Request received", as opposed to "Email sent".

| improve this answer | |

Sure, when someone is attacking the user, as opposed to the system. When an attacker is going after a person and knows their target's email address, they can enter the email address into dozens or hundreds of systems and see how each responds. This way they build up a list of interesting systems to attack to learn about the user. (As a bonus, none of the systems have any of their anti-hacking systems triggered, because there was only one login attempt for a specific user account.)

| improve this answer | |

Usually username enumeration is seen as a first step towards bruteforce or dictionary-based attacks; if you know a username is valid, then you know you aren't completely wasting your time trying to log into it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.