actually another way to prevent any kind of automated attack is to use the "word in the image" technique common to free sign-up sites like yahoo. You just have an extra field into which the user types the word they see in the image (you can get components to generate these randomly). This is probably going to be too much for a lot of clients though...
Monday, February 24, 2003, 5:56:15 PM, you wrote: SB> Well heres one suggestion (Just a theory). SB> 1. You use Javascript to execute your login form, so in way it restricts the SB> user to a Javascript/Browser friendly program. SB> 2. You randomly create a session.string value in CFMX (Seed Value); SB> 3. You set this string value to a Javascript Variable named "foo" or SB> whatever you want. SB> 4. You randomly create 3x session.string value in CFMX (1=Key, 2=Username, SB> 3=Password); SB> 5. Using these random strings, create 3 form fields on the page (1st Hidden, SB> 2,3 text); SB> 6. Make an OnClick to either button type, or image to basically take the SB> Javascript Seed Value and place it into the hidden form field value. SB> 7. Make a call to action to a page (that invokes a cfc). SB> 8. based on your session variables, compare them against to the SB> form.variables for starters. SB> 9. If they match then do a database lookup/handshake. SB> 10. Do a simple 3 strikes and your out system against the session.ip (if SB> they use a proxy cycler, well log the proxy IP.. eventually you may block SB> the proxy ips before any damage is done) SB> Now this isn't 100% full proof and un-tested, but the theory is, try and SB> make it a randomly generated form of some kind, in that keep vars names SB> random so that any text pattern searching on the cfm page aren't allways the SB> same (even mixup where they lie in response to line positions). SB> What this in theory does is basically say to the hacker, if you can: SB> a) have a attackscript/program that can simulate javascript / or know how to SB> read the page, find the random field names, then simulate a form post on SB> those names. SB> b) have a way to edit/updated your own header packets SB> c) have a way to map to the correct seed against form values SB> d) have a way to cycle through proxies SB> Then your welcome to hack the shit out of my site :D In a nutshell, its just SB> a crazy whacky security theory i have had and in truth not allot of thought SB> has gone into it... SB> One theory i also had, and once again this is just a theory is: SB> 1. You have a frontline of say 5 call to action pages (cloned off of the SB> original) that all point to the one package cfc SB> 2. You rename these files randomly each day SB> 3. You have 5 login pages (cloned off of the original) that are stored in SB> randomfolder/randomname.cfm format SB> 4. These are stored in their own unique application scope that timeout daily SB> 5. You then redirect the user to one of the 5 each time the user hits the SB> "login area" SB> 6. You apply the above to prevent formpost similiators SB> 7. You pray your client hasn't got a password of "ima/egghead" format. SB> 8. You hope they don't have ftp access :D SB> Like i said all theories, how useful they are is beyond my time :D never put SB> it into place until Spike scared the shit out of me at the preso of his.. SB> man i was torn between Spike and Jesse... hard call to make, so i only SB> caught first half of spikes and last half of jesses... DAMN YOU MXDU :D SO SB> much to learn so little time. SB> "Adam Chapman" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] >> >> Hey Everyone.. >> >> At the hack-proofing CFMX session at MXDU, Spike >> Mentioned a 'dictionary attack' or something similar >> Where someone will pound your cf templates with lots-o >> Username/password combos.. >> >> What are some of the methods peoples use to try and >> Safeguard against this kind of thing..? >> >> Regards, >> Adam Chapman >> >> Virtualtours.com.au >> mailto:[EMAIL PROTECTED] >> Phone: 1300 366 122 >> (Int: +61 3 9720 5733) >> Fax: +61 3 9720 6377) >> >> >> SB> --- SB> You are currently subscribed to cfaussie as: [EMAIL PROTECTED] SB> To unsubscribe send a blank email to [EMAIL PROTECTED] SB> MX Downunder AsiaPac DevCon - http://mxdu.com/ --------------------------------------- Life is poetry - write it in your own words. --------------------------------------- Toby Tremayne Technical Team Lead Code Poet and Zen Master of the Heavy Sleep Toll Solutions 154 Moray St Sth Melbourne VIC 3205 +61 3 9697 2317 0416 048 090 ICQ: 13107913 --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/
