Preventing brute force attacks by escalating failed login delay
Posted At : March 12, 2007 9:29 AM
A recent comment on blogcfc.com encouraged me to modify the code that protects my application against brute force attacks. The following article recommends escalating the failed login delay based on the number of failed attempts. While this will not bother legitimate users, it will definitely annoy and possibly prevent the potential hacker (then again, do you really want to annoy hackers?)
The following code snippet implements the delay in ColdFusion.
<cfif [login successful...]>
<cfelse>
<cfparam name="session.FailedLogin" default="0" >
<cfset session.FailedLogin = session.FailedLogin+1>
<cfset createObject("java", "java.lang.Thread").sleep(JavaCast("int", session.FailedLogin*500))>
</cfif>
<cfelse>
<cfparam name="session.FailedLogin" default="0" >
<cfset session.FailedLogin = session.FailedLogin+1>
<cfset createObject("java", "java.lang.Thread").sleep(JavaCast("int", session.FailedLogin*500))>
</cfif>
Comments (2) |
Print |
Send |
del.icio.us
| 
Digg It!
| 
Linking Blogs
| 1549 Views | Related Categories:
ColdFusion,
Security
![[Valid RSS]](http://www.shlomygantz.com/blog/valid-rss.png "Validate my RSS feed")
<cfif session.FailedLogin GT 10>
<CFABORT>
</cfif>
While new sessions would be created, the thread will not be sleeping for eternity. The attack you are describing at that point would be more of a DoS attack.
Obviously, locking accounts after n failed attempts should be implemented as well.