Evaluation of password hashing schemes in open source web platforms

Abstract

Nowadays, the majority of web platforms in the Internet originate either from CMS to easily deploy websites or by web applications frameworks that allow developers to design and implement web applications. Considering the fact that CMS are intended to be plug and play solutions and their main aim is to allow even non-developers to deploy websites, we argue that the default hashing schemes are not modified when deployed in the Internet. Also, recent studies suggest that even developers do not use appropriate hash functions to protect passwords, since they may not have adequate security expertise. Therefore, the default settings of CMS and web applications frameworks play an important role in the security of password storage. This paper evaluates the default hashing schemes of popular CMS and web application frameworks. First, we formulate the cost time of password guessing attacks and next we investigate the default hashing schemes of popular CMS and web applications frameworks. We then apply our framework to perform a comparative analysis of the cost time of password guessing attacks between the various CMS and web application frameworks. Finally, considering that intensive hash functions consume computational resources, we analyze hashing schemes from a different perspective. That is, we investigate if it is feasible and under what conditions to perform slow rate denial of service attacks from concurrent login attempts. Through our study we have derived a set of critical observations. The conjecture is that that the security status of the hashing schemes calls for changes with new security recommendations and updates to the default security settings.

Security Challenges Behind the Development and Increased Use of Open Source Web Content Management Systems

“…It can be seen from the data that there were attempts to block or to takeover the control of the websites. Further analysis of the attack report clearly shows a large number generic attacks, exactly as we expected, aimed at the well-known address of the WCMS administrative panel, which is generally open, and which often has no available option to change [22]. This was the case with the Elxis WCMS observed, in which the security system collected this information because the attacker requested to log into a non-existent URL, and eventually the system detected it as a "Directory traversal attack".…”

Hash Algorithm In Verification Of Certificate Data Integrity And Security

“…As today's technology evolves, it has been found that many CMS frameworks and web applications use outdated hash functions, an arbitrary number of hash iterations. Notably, popular WordPress still uses MD5 with low hash iterations [18]. So in verifying the data security integrity of this certificate, SHA-256 hashing is applied which is more qualified.…”

A Novel Improvement With an Effective Expansion to Enhance the MD5 Hash Function for Verification of a Secure E-Document

“…The research has examined some types of attacks that are effective against the current algorithm, such as dictionary attacks, the rainbow table attacks, and brute force attacks. Researchers have discussed the weakness in the solutions that are currently used to solve the weakness of the MD5 algorithm in Web applications [12].…”