2

I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the caller.

The api is only available though SSL 3.0 or TLS 1.0.

What are the main attacks which would be possible in this scenario?

The answer and comments to this SO question seem to indicate that if the risk of attack is proportionally low, more complexity will not improve security but will add complexity. I would like to know the highest risk areas for attack to determine the appropriate counter-measures, if necessary.

1 Answer 1

2

The attacks against this system fall into three separate categories; Authentication, Session Management, and attacks against TLS.

  1. The Mozilla Secure Coding Guideline for Authentication details the following attacks of concern:

    • online & offline brute force password guessing

    • user enumeration

    • mass account lockout (Account DoS)

    • offline hash cracking (time trade-off)

    • lost passwords

  2. The Mozilla Secure Coding Guideline for Session Management details the following attacks of Concern:

    • Session Hijacking
    • Session Fixation
    • Brute Forcing Valid Session IDs
  3. The OWASP Transport Layer Security Cheat Sheet details various ways that TLS/SSL can be made more secure. Some of the concerns are:

    • Renegotiation DoS

    • Weak ciphers/NULL encryption method

    • Invalid certificate

    • divulging session id over an insecure channel

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .