<div class="widget">
    <div class="widget-header">
      <div class="title">
        <span class="fs1" aria-hidden="true" data-icon="&#xe092;"></span> A6 - Sensitive Data Exposure - Insecure Password Storage
      </div>
    </div>
    <div class="widget-body">
      <div id="accordion1" class="accordion no-margin">
        <div class="accordion-group">
          <div class="accordion-heading">
            <a href="#collapseOne" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
              <i class="icon-info icon-white">
              </i>
              Description
            </a>
          </div>
          <div class="accordion-body in collapse" id="collapseOne" style="height: auto;">
            <div class="accordion-inner">
			  <p class="desc">
              The OWASP description - Many web applications do not properly protect sensitive data, such as credit cards, SSNs, and authentication credentials, with appropriate encryption or hashing. Attackers may steal or modify such weakly protected data to conduct identity theft, credit card fraud, or other crimes.
 			  </p>
			  <p class="desc">
 			  Railsgoat does hash user passwords. Unfortunately, it does so using an extremely weak algorithm (MD5). Generally speaking, a strong algorithm and per-user salt can greatly improve the security of a hashed value. Also important to note, hashing and encryption are not the same. Encryption is meant to be reversible using some secret information, hashing is not, hashing is a one-way function not meant to be reversible.
			  </p>
			  <p class="desc">
			 All that being said, there are groups within security organizations that devote themselves to threat models built around this topic so clearly, this description does not encompass all scenarios. However, our recommendation is better than hashing using MD5 <i class="icon-wink-2"></i>.
			  </p>
            </div>
          </div>
        </div>
        <div class="accordion-group">
          <div class="accordion-heading">
            <a href="#collapseTwo" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
              <i class="icon-bug icon-white">
              </i>
              Bug
            </a>
          </div>
          <div class="accordion-body collapse" id="collapseTwo" style="height: 0px;">
            <div class="accordion-inner">
	          <p>
              Within app/models/user.rb:
 			  </p>
 			  <pre class="ruby">
	 		   before_save <span style="background-color:yellow">:hash_password</span>
	
				def self.authenticate(email, password)
			       auth = nil
			       user = find_by_email(email)
			       if user
			         if user.password == <span style="background-color:yellow">Digest::MD5.hexdigest(password)</span>
			           auth = user
			         else
			          raise "Incorrect Password!"
			         end 
			       else
			          raise "#{email} doesn't exist!"
			       end
			       return auth
			    end
			
				def hash_password
			    	if self.password.present?
			      		self.password = <span style="background-color:yellow">Digest::MD5.hexdigest(password)</span>
			    	end
			    end
	 
			  </pre>
			  
            </div>
          </div>
        </div>
        <div class="accordion-group">
          <div class="accordion-heading">
            <a href="#collapseThree" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
              <i class="icon-lightning icon-white">
              </i>
              Solution
            </a>
          </div>
          <div class="accordion-body collapse" id="collapseThree" style="height: 0px;">
            <div class="accordion-inner">
              <p><b>Password Storage - ATTACK</b></p>
 			  <p class="desc">
			 	 Using the passwords stored within db/seeds.rb file, create a wordlist and leverage a password cracking tool such as John The Ripper to crack those passwords.
			  </p>
			  <p><b>Password Storage - SOLUTION</b></p>
			  <p class="desc">
				A simple solution here would be to enforce a per-user salt in creating a BCrypt hash. You would need to alter the db schema to add a password_salt and password_hash columns to the table.
			  </p>
			  <pre class="ruby">	
				def self.authenticate(email, password)
				    user = find_by_email(email)
				    if user and user.password_hash == <span style="background-color:yellow">BCrypt::Engine.hash_secret(password, user.password_salt)</span>
				        user
				    else
				       "Invalid Credentials Supplied"
				    end
				end
				
				def hash_password
				    if self.password.present?
				      <span style="background-color:yellow">self.password_salt = BCrypt::Engine.generate_salt</span>
				      <span style="background-color:yellow">self.password_hash = BCrypt::Engine.hash_secret(self.password, self.password_salt)</span>
				    end
				end
			  </pre>	
            </div>
          </div>
        </div>
		<div class="accordion-group">
          <div class="accordion-heading">
            <a  style="background-color: rgb(181, 121, 158)" href="#collapseFour" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
              <i class="icon-aid icon-white">
              </i>
              Hint
            </a>
          </div>
          <div class="accordion-body collapse" id="collapseFour" style="height: 0px;">
            <div class="accordion-inner">
              How protected are those passwords in the database against cracking?
            </div>
          </div>
        </div>
      </div>
    </div>
  </div>