Did you get onto that chick the messaged you spike? Regards
Steve Onnis Domain Concept Designs +61 422 337 685 +61 3 9444 7504 http://www.domainconceptdesigns.com <http://www.domainconceptdesigns.com> ("If you think it can't be done, you haven't asked me!") - Steve Onnis -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Spike Sent: Monday, February 24, 2003 4:31 PM To: CFAussie Mailing List Subject: [cfaussie] RE: Dictionary attacks Sorry for the delay in responding... I was working on something else for the last hour or so. I have a loginBombProtector() function that should provide some level of protection for this sort of attack. It accepts 4 parameters: persistentScope - Application or server scope in which to store ip address information for login attempts. maxLoginAttempts - An integer indicating the maximum number of login attempts to permit before locking out the user. loginDimer - An integer indicating the amount of time a user has in which to make less than the permitted number of login attempts. lockoutDuration - An integer indicating the amount of time a user should be locked out for once their IP address is blocked. timeUnit - Any of the valid values for the first parameter of the dateDiff() function. i.e. 's','n','h','d','m' or 'y' It returns true if the user has not been locked out, and false if they have. I modified it from some code I used on a restricted search engine so it hasn't been heavily tested, but it should be ok. Typical usage: <cfif loginBombProtector(server,3,1,5,'n')> <!--- login code goes here ---> <cfelse> <!--- error messages, ip logging and other blocked user stuff goes here ---> <cfabort> </cfif> Example code below (Watch out for email client wrapping in the <cfscript> block): ############################################## <cfscript> function loginBombProtector(scope,maxLogins,timeInterval,lockoutDuration,timeUnit ) { var thisUser = ''; if (not structKeyExists(scope,'ipList')) { scope.ipList = structNew(); } /* Set up a structure in the scope scope to hold login attempt info */ if (not structKeyExists(scope.ipList,cgi.remote_addr)) { scope.ipList[cgi.remote_addr] = structNew(); scope.ipList[cgi.remote_addr]['count'] = 0; scope.ipList[cgi.remote_addr]['logintimer'] = Now(); scope.ipList[cgi.remote_addr]['blocked'] = false; } thisUser = scope.ipList[cgi.remote_addr]; /* Increment the count for this value of cgi.remote_addr */ thisUser.count = thisUser.count + 1; /* Check to see if this user is currently blocked. If so, check if they have served their timeout period and unblock if necessary. */ if (thisUser.blocked) { if (dateDiff(timeunit,thisUser.loginTimer,Now()) GT lockoutinterval) { thisUser.blocked = false; thisUser.logintimer = Now(); thisUser.count = 0; } } /* Check if the count is greater than the maximum allowed and make sure the user is not currently blocked */ if (thisUser.count GT maxLoginAttempts AND NOT thisUser.blocked) { /* The count is greater than permitted max. Check if these login attempts have occured inside the permitted time period. If so, block the user. If not, reset the counter and timer */ if (datediff(timeunit,thisUser.logintimer,Now()) GT timeinterval) { thisUser.blocked = false; thisUser.count = 1; thisUser.logintimer = Now(); } else { thisUser.blocked = true; } } return thisUser.blocked; } </cfscript> <cfset maxLoginAttempts = 10> <cfset timeinterval = 1> <cfset lockoutinterval = 5> <cfset foo = loginBombProtector(server,10,1,5,'s')> <cfoutput>#foo#</cfoutput> <cfdump var="#server.ipList#"> ############################################## Spike Stephen Milligan Team Macromedia - ColdFusion Co-author 'Reality Macromedia ColdFusion MX: Intranets and Content Management' http://spikefu.blogspot.com > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf > Of Adam Chapman > Sent: 24 February 2003 15:38 > To: CFAussie Mailing List > Subject: [cfaussie] Dictionary attacks > > > Hey Everyone.. > > At the hack-proofing CFMX session at MXDU, Spike > Mentioned a 'dictionary attack' or something similar > Where someone will pound your cf templates with lots-o > Username/password combos.. > > What are some of the methods peoples use to try and > Safeguard against this kind of thing..? > > Regards, > Adam Chapman > > Virtualtours.com.au > mailto:[EMAIL PROTECTED] > Phone: 1300 366 122 > (Int: +61 3 9720 5733) > Fax: +61 3 9720 6377) > > > --- > You are currently subscribed to cfaussie as: > [EMAIL PROTECTED] To unsubscribe send a blank email to > [EMAIL PROTECTED] > > MX Downunder AsiaPac DevCon - http://mxdu.com/ > > --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/ --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/
