Wish List: AHHHHHHHHHH PACKET SNIFFING BADNESS

Do I understand this correctly:

// check if the user id and password combination exist in database
$sql = "SELECT user_id
FROM si_users
WHERE user_email = '$userEmail' AND user_password = md5('$password')";


Does that mean that the password is sent "in the clear" to Simple Invoices????

May I suggest this:
http://pajhome.org.uk/crypt/md5

it allows the MD5 hashing to occur on the client side so that only the hash is sent........................ AND for the super paranoid:

IF you give each login a unique number, THEN hash the already hashed password on the server, and the Unique Number....

ON the client side.... Hash the password, then the hashed password with the unique number,

Compare those two hashs with eachother, along with validating the Unique number hasn't already been used before, even if someone gets that hash it's no good anymore (the number's been used), and that's How the login should work......................

Any chance of this happening???

If not I've done it before......... I'm sure I could get it to work with Simple Invoices.............. but I have NO IDEA how svn works, and I'm not sure when i'd have the time............. are you interested (I guess I'm talking to justin)???


I use my neighbors unsecured WIFI connection to get online.......... hence I worry that someone will packet sniff out my info.......... I think it's very important to get this working........

Any comments??? You think you can do it or do you want me to work on it???

Thanks,
Chris

Hi

I'm no security/php expert but heres my 2 cents.

At this point in the script the password is in plain text...
$password = $_POST['pass'];

At this point in the script it is hashed so it is not...
WHERE user_password = md5('$password')";

So i guess the answer is.... I DONT KNOW! :D

Unless the password could be hashed in the form before it appears in the $_POST variable I don't see how more safe it could be!

Hey Justin... can you not do this instead!

WHERE user_password = md5('$_POST[pass]')";

and remove the
$password = $_POST['pass'];

Not sure whether that will work or not but it saves keeping the plain text password in the $password variable if it does??

The only other issue is whether the password variable is cleared once the form is submitted! I assume these are once the page changes... is that correct?

Excuse me if that's dum, I ain't all that up on php.

Danny

So above was my packet sniffing adventure.......... the user I tested was "Thisisatest@cahbilling.com" and the password I used was "Password" you can see that both are there...

Like danny was saying........... Once PHP has it it's already been sent accross the internet.

So to make it more secure you have to Hash it on the client side........ that's why you NEED to use javascript (or some other CLIENT side scripting)...

Anything you do in PHP has to be given to the server first.... to give it to the server you have to send it clear text across the internet...

I'll play with it more later...
TTFN,
Chris

Thanks guys,

can some of you guys read up on the web on the best way to do this in php

problem
login.php uses $_POST[] to pass the 'password' - and the $_POST can be read

solution:
encrypt the $_POST before its send, etc.. or something

can https/ssl solve this?

note:
javascript only as last resort

refer:
http://www-128.ibm.com/developerworks/opensource/library/os-php-encrypt/
http://www.onlamp.com/pub/a/php/2001/07/26/encrypt.html

Cheers

Justin

Hey Chris,

if you do the code, just post here what you did - you can attach the files to a new bug in our issues system
http://code.google.com/p/simpleinvoices/issues/list

Cheers

Justin

neither of those articles really cover what we're talking about....... (I find that strange because their titles would lead you to believe they would....)

One article does state:

"One final very important note to make about PHP and encryption is that any data transmitted between the server and the client (and vice-versa) is not secure while in transit! PHP is a server-side technology, and can do nothing to prevent snoopers from watching this data in transit. Therefore, if you are interested in implementing a complete security application, I would suggest checking out Apache-SSL, or any of the other reputable secure-server implementations."

Yes he also mentions Apache-SSL.... but then I'd have to pay more for my hosting :(

I'll make changes later this week (maybe even tonight) and post them...

Thanks for everyones (Danny and justin) comments,
Chris

I also think the only real solution is with https. It's nice to login with a encrypted password. But then all the other transfer isn't encrypted. So if someone is sniffing, he can catch all the other stuff, even if he hasn't the password...

Possibly another option if are running apache is to disable the login in SI and then create a .htaccess file on the server for the SI directory.

You could make the .htaccess file as strict as you want.

Danny

Like I said I really want this to be in the Official release, So I did it with an option........ Hopefully justin will add it....

Also if you just use MD5's that's good.......... but if you add a challenge system that's better (Because the MD5ed Password doesn't just become the "New" Password With a challenge system the clear MD5 is never sent, so you can't get it sniffing, and without either the md5 of the password, or the password itself you can't get access)...

SO...................

First change add MD5.js to include folder

2nd change: Add two Config Variables to Config.php

/*If you want JavaScript MD5 hashing to occur so that you can run Simple Invoices on a Non-Https Server with better security Turn Uncomment MD5Auth, Generally if you do that you should turn on ChallengeLife too. ChallengeLife sets how long before a Challenge leaving the server expires in minutes (480 is a good number I think). Defaults to Off (Please don't use Simple invoices with this off, on an non- https internet server) */
$MD5Auth = FALSE;
$ChallengeLife = 0;

3rd change: We need a new table in the database to monitor Challenges (comment in Login.php):

CREATE TABLE `si_challenges` (
`challenges_key` INT( 11 ) NOT NULL ,
`challenges_timestamp` TIMESTAMP ON UPDATE CURRENT_TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
);

4th change: Rework login.php


If you need explanation on why I did certain things just ask... Mostly I tried not to mess with justins flow, and I tried to make sure if you left both of my config options at False and 0 the program would generally behave like it used to....

I still haven't tested it throughly but I did make sure that with True and 480 it works....
Here's what my login.php looks like:

[code]<?php
// we must never forget to start the session
/*
CREATE TABLE si_users (
user_id int(11) NOT NULL auto_increment,
user_email VARCHAR(100) NOT NULL,
user_name VARCHAR(100) NOT NULL,
user_group VARCHAR(10) NOT NULL,
user_domain VARCHAR(10) NOT NULL,
user_password CHAR(32) NOT NULL,

PRIMARY KEY (user_id)
);

INSERT INTO si_users (user_id, user_email, user_name, user_group, user_domain, user_password) VALUES ('','guest@simpleinvoices.org','guest','1','1', md5('guest'));
INSERT INTO si_users (user_id, user_email, user_name, user_group, user_domain, user_password) VALUES ('','demo@simpleinvoices.org','demo','1','1', md5('demo'));
INSERT INTO si_users (user_id, user_email, user_name, user_group, user_domain, user_password) VALUES ('','admin@simpleinvoices.org','admin','1','1', md5('admin'));

CREATE TABLE `si_challenges` (
`challenges_ key` INT( 11 ) NOT NULL ,
`challenges_ timestamp` TIMESTAMP ON UPDATE CURRENT_TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
);

*/

include 'config/config.php';
include "lang/$language.inc.php";
include "include/hmacmd5.php";
session_start();

$errorMessage = '';
if (isset($_POST['user']) && isset($_POST['pass'])) {

$conn = mysql_connect( $db_host, $db_user, $db_password);
mysql_select_db( $db_name, $conn);

$userEmail = $_POST['user'];
if ($_POST['pass'] == $_POST['md5']){
$password = $_POST['pass'];
}
else {
if($MD5Auth==True){
$NoJSonClient=True;
}
$password = md5($_POST['pass']);
}
if ($ChallengeLife>0){
$ChallengeKeySubmitted = $_POST['ChallengeKey'];
}

// Grab Password from database
$sql = "SELECT *
FROM si_users
WHERE user_email = '$userEmail' ";

$result = mysql_query($sql, $conn) or die('Query failed. ' . mysql_error());
$credentials = mysql_fetch_array($result);
$storedPassword=$credentials[user_password];



if ($ChallengeLife>0) {
$DeleteOldChallenges = 'DELETE FROM `si_challenges` WHERE `challenges_timestamp` < DATE_SUB(now(),INTERVAL $ChallengeLife Minute)';
mysql_query($DeleteOldChallenges, $conn);
$sql = "SELECT *
FROM si_challenges
WHERE challenges_key = '$ChallengeKeySubmitted' ";
$result = mysql_query($sql, $conn) or die('Query failed. ' . mysql_error());
# echo "Found or not the key in DB";
if (mysql_num_rows($result) >= 1) {
//Challenge was valid
# echo $ChallengeKeySubmitted;
$DeleteUSEDChallenge = 'DELETE FROM `si_challenges` WHERE `challenges_key` = `$ChallengeKeySubmitted`limit 1';
mysql_query($DeleteUSEDChallenge, $conn);
# echo "Deleted Used Key $ChallengeKeySubmitted";
if($password==hmac_md5($ChallengeKeySubmitted, "$storedPassword")){
$_SESSION['db_is_logged_in'] = true;
// after login we move to the main page
header('Location: .');
exit;
} else {
# echo $ChallengeKeySubmitted;
$DB=hmac_md5($ChallengeKeySubmitted, "$storedPassword");
$errorMessage = "Sorry, wrong user / password";
}
} else {
$errorMessage = 'Sorry, the login timed out. Please try again';
}
}elseif ($password==$storedPassword){
$_SESSION['db_is_logged_in'] = true;
// after login we move to the main page
header('Location: .');
exit;
}else {
$errorMessage = 'Sorry, wrong user / password';
}
}

if($ChallengeLife>0) {
$Challenge_Key=Rand(0,99999999999);
# $Challenge_Key=1;
$conn = mysql_connect( $db_host, $db_user, $db_password);
mysql_select_db( $db_name, $conn);
mysql_query("INSERT INTO si_challenges (challenges_key) VALUES ($Challenge_Key)",$conn);
}

?>
<html>
<head>

<?php if($MD5Auth==True){?>

<script src="include/md5.js"></script>
<script language="JavaScript"><!--

function login(f) {

<?php if ($ChallengeLife>0){?>
f['md5'].value = hex_md5(f['pass'].value);
f['pass'].value = hex_hmac_md5(f['ChallengeKey'].value, f['md5'].value);
f['md5'].value = hex_hmac_md5(f['ChallengeKey'].value, f['md5'].value);
<?php } else {?>
f['md5'].value = hex_md5(f['pass'].value);
f['pass'].value = hex_md5(f['pass'].value);
<?php }?>

return true;

}

//--></script>

<?php }?>

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Simple Invoices Login</title>
<link rel="stylesheet" type="text/css" href="src/include/css/login.css">

</head>

<body class="login" >
<div class="Container">
<?php if($MD5Auth==True){?>
<noscript>
<p align="center"><strong><font color="#990000">JavaScript must be enabled for MD5 login.</font></strong></p>
</noscript>

<?php
}
if ($errorMessage != '') {
?>
<p align="center"><strong><font color="#990000"><?php echo $errorMessage; ?></font></strong></p>
<?php
}
?>
<div id="Dialog">
<!--
<div align=center id="disclaimerbox">
<img src="./images/common/important.png"></img>
<strong>Annoucement<br /></strong><br>This is an important annoucement
<hr></hr>
</div>
-->
<h1>Simple Invoices</h1>
<!--
<div id="loginbox" class="hasDisclaimer" >

<div id="formbox">
-->

<form action="" method="post" name="frmLogin" id="frmLogin" <?php if($MD5Auth==True){?>onSubmit="return login(this);"<?php }?>>
<input type="hidden" name="action" value="login" />
<input type="hidden" name="cookieverify" value="" />
<input type="hidden" name="redirect" value="" />

<?php if($MD5Auth==True){?>
<input type="hidden" name="md5" value="">
<?php }?>
<?php if($ChallengeLife>0){?>
<input type="hidden" name="ChallengeKey" value="<?php echo $Challenge_Key;?>">
<?php }?>

<dl>
<dt>Email:</dt>
<dd><input name="user" type="text" id="user" /></dd>

<dt>Password:</dt>
<dd>
<input name="pass" type="password" id="pass" />
<!--
<span>(<a href="login.php">I forgot my password/username</a>)</span>
-->
</dd>

<dd><input type="checkbox" name="remember_me" /> Remember me on this computer</dd>
<dd> <input type="submit" value="login" /></dd>
<!-- <dd><input type="submit" value="Sign in" /></dd> -->
<!--
<label for="username">Username</label>
<input name="user" type="text" id="user"/>
<BR>
<label for="password">Password</label>
<input name="pass" type="password" id="pass"/>
-->
<!--
<label for="language">Language</label>
<select id="language" name="language">
<option value="en" SELECTED="yes">English (United States)</option>

</select>
-->
<!--
<div class="form_actions">
<dd> <input type="submit" value="login" /></dd>
</div>
-->
</dl>
</form>

</div>


</div>





<!--
<form action="" method="post" name="frmLogin" id="frmLogin">
<table width="400" border="1" align="center" cellpadding="2" cellspacing="2">
<tr>
<td width="150">User Id</td>
<td><input name="txtUserId" type="text" id="txtUserId"></td>
</tr>
<tr>
<td width="150">Password</td>
<td><input name="txtPassword" type="password" id="txtPassword"></td>
</tr>
<tr>
<td width="150">&nbsp;</td>
<td><input name="btnLogin" type="submit" id="btnLogin" value="Login"></td>
</tr>
</table>
</form>
-->

</body>
</html>
[/code]

And my packet sniffing Results (2 successful login attempts below, notice how the Password changes because of the challenge):


12:41:33 - 08.04.2007 Protocol: TCP Service: HTTP
Source Address: 10.15.20.10 Destination Address: 64.247.42.189
Source Port: 3919 Destination Port: 80
45 00 01 20 f2 66 40 00 80 06 7d a4 0a 0f 14 0a 40 f7 E f@ } @
2a bd 0f 4f 00 50 ed a5 87 d8 f6 5c e5 ed 50 18 80 52 * O P \ P R
aa 23 00 00 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 # Content-Type:
61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d application/x-www-
66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 0d 0a 43 form-urlencoded C
6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 36 ontent-Length: 176
0d 0a 0d 0a 61 63 74 69 6f 6e 3d 6c 6f 67 69 6e 26 63 action=login&c
6f 6f 6b 69 65 76 65 72 69 66 79 3d 26 72 65 64 69 72 ookieverify=&redir
65 63 74 3d 26 6d 64 35 3d 34 62 37 62 33 61 63 34 31 ect=&md5=4b7b3ac41
65 65 33 31 35 38 36 39 32 63 37 34 36 30 36 63 30 31 ee3158692c74606c01
37 30 65 37 30 26 43 68 61 6c 6c 65 6e 67 65 4b 65 79 70e70&ChallengeKey
3d 31 32 30 33 30 31 31 33 36 34 26 75 73 65 72 3d 63 =1203011364&user=c
61 76 65 72 25 34 30 63 6f 6d 70 75 74 65 72 61 75 74 aver%40computeraut
68 6f 72 69 74 79 68 61 77 61 69 69 2e 63 6f 6d 26 70 horityhawaii.com&p
61 73 73 3d 34 62 37 62 33 61 63 34 31 65 65 33 31 35 ass=4b7b3ac41ee315
38 36 39 32 63 37 34 36 30 36 63 30 31 37 30 65 37 30 8692c74606c0170e70


12:43:36 - 08.04.2007 Protocol: TCP Service: HTTP
Source Address: 10.15.20.10 Destination Address: 64.247.42.189
Source Port: 3922 Destination Port: 80
45 00 01 1f f3 0d 40 00 80 06 7c fe 0a 0f 14 0a 40 f7 E @ | @
2a bd 0f 52 00 50 3e a1 b7 05 fb bd 5b 52 50 18 7f cd * R P> [RP 
a7 33 00 00 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 3 Content-Type:
61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d application/x-www-
66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 0d 0a 43 form-urlencoded C
6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 35 ontent-Length: 175
0d 0a 0d 0a 61 63 74 69 6f 6e 3d 6c 6f 67 69 6e 26 63 action=login&c
6f 6f 6b 69 65 76 65 72 69 66 79 3d 26 72 65 64 69 72 ookieverify=&redir
65 63 74 3d 26 6d 64 35 3d 39 36 35 33 37 38 36 38 62 ect=&md5=96537868b
34 61 66 34 38 30 63 35 38 61 65 66 31 63 37 35 30 37 4af480c58aef1c7507
33 39 64 39 65 26 43 68 61 6c 6c 65 6e 67 65 4b 65 79 39d9e&ChallengeKey
3d 33 35 34 37 32 35 35 33 35 26 75 73 65 72 3d 63 61 =354725535&user=ca
76 65 72 25 34 30 63 6f 6d 70 75 74 65 72 61 75 74 68 ver%40computerauth
6f 72 69 74 79 68 61 77 61 69 69 2e 63 6f 6d 26 70 61 orityhawaii.com&pa
73 73 3d 39 36 35 33 37 38 36 38 62 34 61 66 34 38 30 ss=96537868b4af480
63 35 38 61 65 66 31 63 37 35 30 37 33 39 64 39 65 c58aef1c750739d9e

(sorry for taking so long... You know.... Real Life and all.... But I did it within the week I gave myself)


Chris

Something like that..........

If config is set to use it, but javascript isn't on in the browser, it displays a message in the browser stating that "JavaScript must be enabled for MD5 login." It then basically reverts to the old system.

There may be a small problem if javascript is ON in the browser but it can't use the MD5 file... (I don't see how but if the browser tried to do the javascript, but botched it and sent in the un-evaulated string of "hex_hmac_md5(f['ChallengeKey'].value, f['md5'].value)" or something) that would (obviously) cause problems...

But Firefox, IE, safari, and Konqueror all liked the script before (I haven't tested it on anything but Firefox, since about errr a year ago)... It's also a relatively simple script, so it shouldn't be a problem....


Chris

Hey Caver,

just looking add your posts now (note: my attention span is limited so it took awhile to get to reading all the posts correctly :) ), awesome work on the challenge system!!!!!!!

question:
if i set $MD5Auth = FALSE; in config.php does that mean the current (non js) login work is used instead of the new js based one
- if so thats great and i'll add it into Simple Invoices - just gotta think what if some people dont have javscript enabled etc.. just thinking about PDAs, mobile internet handhelds etc (that may not have js) that i would like Simple Invoices to work with in the long run.

Cheers

Justin

Thanks Chris,

Once you post your fix for

If $ChallengeLife > 0 but $MD5Auth = FALSE upon another look at my code fails every login... (I'll post a fix soon)

i'll put this code into Simple Invoices, Thanks again

also as you seem to be security concerned (im not :) ) can you check thought the Simple Invoices authentication system to see if theres any security holes - it would be a great help!!!

Cheers

Justin

Hey Chris,

Just adding this code into svn for testing but notice the reference to a new file
include(include/hmacmd5.php)

is this required? if so can you post it to the forum as well

Cheers

Justin

Javascript MD5 will not really help us secure the traffic, because MD5 is not secure.

Anyone who knows how to use a packet sniffer will have no trouble taking your "encrypted" md5 hash off to read it at md5lookup.com ... they probably already have a browser plugin for exactly that ;)

If you want to prevent this, you need to look into encrypting all your traffic, which requires SSL. Client-side MD5 is just sweeping your password under the rug.

Chris, no disrespect intended to the obvious effort you've put into this one, but MD5 is not really going to help secure things. SSL will.