Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Top Posters

Who's Online (1)

Powered by Vanilla. Made with Bootstrap.
Account Lockout Attack
  • Xin
    Posts: 3,251
    Account Lockout Attack

    What is it?
    The account lockout attack is an attack on the client, not the server. It causes the victim's account to be locked and inable to access it for a period of time causing disruption and if used at the right time can prove very effective.

    What Sites are Vulnerable?
    Sites that operate an account lockout feature depending on incorrect logins in a certain period of time are vulnerable. Note this only works when the system locks the username not the attempting IP address. As otherwise all you are doing is blocking your self out. Sites employ this lockout feature to prevent bruteforce attacks on passwords, an even more severe attack.

    How to Perform the Attack?
    There are a number of ways to perform this attack, firstly manually get the password wrong three times on a certain account.
    The second method is by editing the cookie, attempt one login, then find the cookie "logins_incorrect=1" or simillar, and change the value to 999, or any number above the limit. This data will then be sent back to the server and stored in the database so the user will be locked out everywhere.
    The third method to perform this attack is the most effective and can cause full scale DOS and disruptions if executed effectively, you can write a script to simultaniously lockout every username in the database, of course here you will need a username list but most forums and CMS's have the memberlist ready to copy. This is most disruptive when performed at the companies busiest times such as Christmas time.

    Real World Examples
    eBay was targetted by this attack to knock the highest bidder offline in bids by logging in incorrectly three times, they were then unable to bid in the final minutes of the auction and consequently the hacker won the bid.
    Xin
  • Clever one the guy on eBay xD
  • Xin
    Posts: 3,251
    said:


    Clever one the guy on eBay xD



    Yeah pretty good idea, especially for high price items, you could block out all the bidders.
    Xin
  • Sh3llc0d3
    Posts: 1,910
    Is it still working for ebay? Sounds very helpful! :P
  • Xin
    Posts: 3,251
    said:


    Is it still working for ebay? Sounds very helpful! :P



    No idea i guess not after that
    Xin
  • D0WNGRADE
    Posts: 220
    Yeah, they hide the highest bidder's username now...guess I know why now. lol
  • Sh3llc0d3
    Posts: 1,910
    I always wondered why they did that, I thought it was to stop people sending messages to users they shouldn't. Learn something new everyday :)