I have a web application that is exposed to the Internet, and am interested in creating alerts, or prioritizing the manual review of failed logins to the web application.
- What thresholds, or formulas should be used to determine when a failed login should be reviewed in more detail? (Assume that an alert could be triggered on a per-user basis, or a per-IP basis.)
Some formulas I tried, but had issues with consistently applying include:
- Success / Failed Logins Per IP
- Success / Failed Logins Per User
- Has the user ever logged in successfully at this IP before? (if not, be more conservative)
I ran a Proof of Concept audit against existing web applications and noticed that there were a few legitimate use cases for the app that skew the straightforward application of the above ratios:
- The user is behind a shared NAT or Proxy (remote office).
- The user is on a home device (or mobile) and the source IP is always changing.
- The machine is shared among many users, and that has a constant IP but many users
Some things I'm trying to prevent (incomplete list) include:
- Brute forcing usernames or passwords. (the lockout period is 24 hours)
- DoSing the application by intentionally locking out users
- Any attack above from a BotNet or TOR
- Internal attacks / suspicious activity from internal users.
The ideal solution would have a consideration for the scenario below, but any general approach, academic whitepaper, or research would be helpful.
- Optional Scenario:: An attacker is using sock puppet accounts to add success logins to the failed account, making him appear as a NAT above.