Overly Restrictive Account Lockout Mechanism

Description

This vulnerability occurs when an application's account lockout feature is too strict, allowing attackers to easily trigger it and lock legitimate users out of their accounts, causing a denial of service.

Extended Description

Account lockout is a common defense against password-guessing attacks, temporarily disabling an account after several failed login attempts. However, if configured too aggressively—with a very low attempt threshold or an excessively long lockout period—this protective measure can be turned against the system itself. Attackers can exploit this by intentionally failing login attempts for targeted user accounts, denying access to legitimate users. To prevent this, developers must balance security with usability, ensuring lockout policies are strict enough to deter brute-force attacks but not so restrictive that they enable easy denial-of-service.

Common Consequences 1

Scope: Availability

Impact: DoS: Resource Consumption (Other)

Users could be locked out of accounts.

Potential Mitigations 3

Phase: Architecture and Design

Implement more intelligent password throttling mechanisms such as those which take IP address into account, in addition to the login name.

Phase: Architecture and Design

Implement a lockout timeout that grows as the number of incorrect login attempts goes up, eventually resulting in a complete lockout.

Phase: Architecture and Design

Consider alternatives to account lockout that would still be effective against password brute force attacks, such as presenting the user machine with a puzzle to solve (makes it do some computation).

Demonstrative Examples 1

A famous example of this type of weakness being exploited is the eBay attack. eBay always displays the user id of the highest bidder. In the final minutes of the auction, one of the bidders could try to log in as the highest bidder three times. After three incorrect log in attempts, eBay password throttling would kick in and lock out the highest bidder's account for some time. An attacker could then make their own bid and their victim would not have a chance to place the counter bid because they would be locked out. Thus an attacker could win the auction.