Blog

How-to Avoid Username Enumeration | Secure Code Warrior

Pieter De Cremer
Published Oct 09, 2017

A side-channel attack is when a hacker can gather information from the physical implementation of a software system rather than a theoretical weakness in the algorithm or bug in the code of the software.

An example I like to use to make this more clear is a way to do username enumeration. If you want to know what username enumeration is or why it is bad, visit our website for a video explanation or play a challenge to see if you can identify it in code.

Now in order to understand how username enumeration can be done through a side-channel attack, you need to have some understanding of how passwords are (or at least should be) handled in modern web applications. A good web application doesn't know your password, it doesn't save or store your password anywhere. So how does it know that what you typed is correct and in fact your password? Well, your password is hashed.

A hashing function is a mathematical operation that is easy to perform one way (although somewhat computationally expensive) but very difficult to reverse and for good hashing algorithms, the output is unique depending on the input. When you register on a website, that hash is stored safely, not your password itself. That means that every time you log-in, the web application hashes your input and compares the hashed results to the stored hash. If you want to learn more about secure password storage, you can do that on our platform.

Hashing input takes some time on a computer and developers always try to optimize everything they write in order for the users to have a smooth experience. One thing that speeds up the program is to skip the hashing when it is not needed. For example, when the username does not exist (and so no password needs to be checked) they can respond to the user immediately. This way they can skip the slow computation of hashing the password. If the username was correct they will hash the password input and compare that to the stored hash.

At this point, you might have guessed where things can go wrong. Even though in reality the hashing takes only a few milliseconds, a hacker can use this added delay to find out if the username he entered was correct or not since a wrong username will have a slightly faster response because no hashing was done. This type of side-channel attack is called a timing attack and it is a good example for how different non-functional requirements can counteract each other. Sometimes code cannot be fast and secure at the same time.

So even though the passwords are handled perfectly, and the message that is displayed is generic and does not advise whether the password or username was incorrect, the system is still vulnerable. The solution is easy, always hash the password or delay sending the reply the time it would take to hash.

The information obtained can be used by an attacker to gain a list of users on system. This information can be used to attack the web application, for example, through a brute force or default username/password attack.

https://www.owasp.org/index.php/Testing_for_User_Enumeration_and_Guessable_User_Account_(OWASP-AT-002)

View Resource
View Resource

Username enumeration is when hackers use brute-force attacks to get username & password info. Learn how to avoid username enumeration with Secure Code Warrior.

Interested in more?

Application Security Researcher - R&D Engineer - PhD Candidate

Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.

Book a demo
Share on:
Author
Pieter De Cremer
Published Oct 09, 2017

Application Security Researcher - R&D Engineer - PhD Candidate

Share on:

A side-channel attack is when a hacker can gather information from the physical implementation of a software system rather than a theoretical weakness in the algorithm or bug in the code of the software.

An example I like to use to make this more clear is a way to do username enumeration. If you want to know what username enumeration is or why it is bad, visit our website for a video explanation or play a challenge to see if you can identify it in code.

Now in order to understand how username enumeration can be done through a side-channel attack, you need to have some understanding of how passwords are (or at least should be) handled in modern web applications. A good web application doesn't know your password, it doesn't save or store your password anywhere. So how does it know that what you typed is correct and in fact your password? Well, your password is hashed.

A hashing function is a mathematical operation that is easy to perform one way (although somewhat computationally expensive) but very difficult to reverse and for good hashing algorithms, the output is unique depending on the input. When you register on a website, that hash is stored safely, not your password itself. That means that every time you log-in, the web application hashes your input and compares the hashed results to the stored hash. If you want to learn more about secure password storage, you can do that on our platform.

Hashing input takes some time on a computer and developers always try to optimize everything they write in order for the users to have a smooth experience. One thing that speeds up the program is to skip the hashing when it is not needed. For example, when the username does not exist (and so no password needs to be checked) they can respond to the user immediately. This way they can skip the slow computation of hashing the password. If the username was correct they will hash the password input and compare that to the stored hash.

At this point, you might have guessed where things can go wrong. Even though in reality the hashing takes only a few milliseconds, a hacker can use this added delay to find out if the username he entered was correct or not since a wrong username will have a slightly faster response because no hashing was done. This type of side-channel attack is called a timing attack and it is a good example for how different non-functional requirements can counteract each other. Sometimes code cannot be fast and secure at the same time.

So even though the passwords are handled perfectly, and the message that is displayed is generic and does not advise whether the password or username was incorrect, the system is still vulnerable. The solution is easy, always hash the password or delay sending the reply the time it would take to hash.

The information obtained can be used by an attacker to gain a list of users on system. This information can be used to attack the web application, for example, through a brute force or default username/password attack.

https://www.owasp.org/index.php/Testing_for_User_Enumeration_and_Guessable_User_Account_(OWASP-AT-002)

View Resource
View Resource

Fill out the form below to download the report

We would like your permission to send you information on our products and/or related secure coding topics. We’ll always treat your personal details with the utmost care and will never sell them to other companies for marketing purposes.

Submit
To submit the form, please enable 'Analytics' cookies. Feel free to disable them again once you're done.

A side-channel attack is when a hacker can gather information from the physical implementation of a software system rather than a theoretical weakness in the algorithm or bug in the code of the software.

An example I like to use to make this more clear is a way to do username enumeration. If you want to know what username enumeration is or why it is bad, visit our website for a video explanation or play a challenge to see if you can identify it in code.

Now in order to understand how username enumeration can be done through a side-channel attack, you need to have some understanding of how passwords are (or at least should be) handled in modern web applications. A good web application doesn't know your password, it doesn't save or store your password anywhere. So how does it know that what you typed is correct and in fact your password? Well, your password is hashed.

A hashing function is a mathematical operation that is easy to perform one way (although somewhat computationally expensive) but very difficult to reverse and for good hashing algorithms, the output is unique depending on the input. When you register on a website, that hash is stored safely, not your password itself. That means that every time you log-in, the web application hashes your input and compares the hashed results to the stored hash. If you want to learn more about secure password storage, you can do that on our platform.

Hashing input takes some time on a computer and developers always try to optimize everything they write in order for the users to have a smooth experience. One thing that speeds up the program is to skip the hashing when it is not needed. For example, when the username does not exist (and so no password needs to be checked) they can respond to the user immediately. This way they can skip the slow computation of hashing the password. If the username was correct they will hash the password input and compare that to the stored hash.

At this point, you might have guessed where things can go wrong. Even though in reality the hashing takes only a few milliseconds, a hacker can use this added delay to find out if the username he entered was correct or not since a wrong username will have a slightly faster response because no hashing was done. This type of side-channel attack is called a timing attack and it is a good example for how different non-functional requirements can counteract each other. Sometimes code cannot be fast and secure at the same time.

So even though the passwords are handled perfectly, and the message that is displayed is generic and does not advise whether the password or username was incorrect, the system is still vulnerable. The solution is easy, always hash the password or delay sending the reply the time it would take to hash.

The information obtained can be used by an attacker to gain a list of users on system. This information can be used to attack the web application, for example, through a brute force or default username/password attack.

https://www.owasp.org/index.php/Testing_for_User_Enumeration_and_Guessable_User_Account_(OWASP-AT-002)

Get Started

Click on the link below and download the PDF of this resource.

Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.

View reportBook a demo
View Resource
Share on:
Interested in more?

Share on:
Author
Pieter De Cremer
Published Oct 09, 2017

Application Security Researcher - R&D Engineer - PhD Candidate

Share on:

A side-channel attack is when a hacker can gather information from the physical implementation of a software system rather than a theoretical weakness in the algorithm or bug in the code of the software.

An example I like to use to make this more clear is a way to do username enumeration. If you want to know what username enumeration is or why it is bad, visit our website for a video explanation or play a challenge to see if you can identify it in code.

Now in order to understand how username enumeration can be done through a side-channel attack, you need to have some understanding of how passwords are (or at least should be) handled in modern web applications. A good web application doesn't know your password, it doesn't save or store your password anywhere. So how does it know that what you typed is correct and in fact your password? Well, your password is hashed.

A hashing function is a mathematical operation that is easy to perform one way (although somewhat computationally expensive) but very difficult to reverse and for good hashing algorithms, the output is unique depending on the input. When you register on a website, that hash is stored safely, not your password itself. That means that every time you log-in, the web application hashes your input and compares the hashed results to the stored hash. If you want to learn more about secure password storage, you can do that on our platform.

Hashing input takes some time on a computer and developers always try to optimize everything they write in order for the users to have a smooth experience. One thing that speeds up the program is to skip the hashing when it is not needed. For example, when the username does not exist (and so no password needs to be checked) they can respond to the user immediately. This way they can skip the slow computation of hashing the password. If the username was correct they will hash the password input and compare that to the stored hash.

At this point, you might have guessed where things can go wrong. Even though in reality the hashing takes only a few milliseconds, a hacker can use this added delay to find out if the username he entered was correct or not since a wrong username will have a slightly faster response because no hashing was done. This type of side-channel attack is called a timing attack and it is a good example for how different non-functional requirements can counteract each other. Sometimes code cannot be fast and secure at the same time.

So even though the passwords are handled perfectly, and the message that is displayed is generic and does not advise whether the password or username was incorrect, the system is still vulnerable. The solution is easy, always hash the password or delay sending the reply the time it would take to hash.

The information obtained can be used by an attacker to gain a list of users on system. This information can be used to attack the web application, for example, through a brute force or default username/password attack.

https://www.owasp.org/index.php/Testing_for_User_Enumeration_and_Guessable_User_Account_(OWASP-AT-002)

Table of contents

Download PDF
View Resource
Interested in more?

Application Security Researcher - R&D Engineer - PhD Candidate

Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.

Book a demoDownload
Share on:
Resource hub

Resources to get you started

More posts
Resource hub

Resources to get you started

More posts