578097 - Enhance CEF Logging for Failed Login to Provide Hash of Wrong Password

Status: RESOLVED DUPLICATE of bug 570410

(Cloud Services Graveyard :: Server: Sync, defect)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Update the failed login (auth failed) detection points to also provide a salted hash of the provided password. This will allow security to review the provided hash and determine if the same incorrect password is being repeatedly used or if the attacker is attempting multiple passwords (e.g. brute force attack).

A few important design notes:
1. Use the same strong hashing algorithm we are using for normal pass storage.
2. Use a salt in the pass hash process but this salt must be different than the salt used for our normal stored passwords.
3. Use the same static salt for all pass hashes provided via this detection point. This way password "whatever" will show up as the same hash in our security logs each time.

Comment 2

[Toby Elliott [:telliott]]

just to make sure I have this clear - you want us to use a single salt to hash all of the passwords?

Comment 3

[Michael Coates [:mcoates] (acct no longer active)]

The approach described in bug 570410 is better. Disregard the notes above on salting. I'll add some notes to the other bug.

Comment 4

[Reed Loden [:reed]]

(In reply to comment #2)
> just to make sure I have this clear - you want us to use a single salt to hash
> all of the passwords?

I dearly hope not.