Password reset token bruteforce
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detect excessive password reset requests for a user.
This may be caused by a malicious actor trying to guess the right password reset token for this user.
Required business logic events
Datadog auto-instruments many event types. Review your instrumented business logic events. This detection requires the following instrumented event:
Strategy
Count the number of password reset attempts for a given user.
Requires the password reset to be flagged using a user event with a usr.login metadata field set to the user receiving the password reset.
The instrumentation should be added on the route processing the password reset request (instead of the one sending the email with the password reset link).
usr.login must be provided and unique, even if the user does not exist.
A Medium signal is then generated if more than 10 password resets for a single user over 5 minutes are found.
Triage and response
- Investigate the IP activity and validate that it is legitimate.
- Review your password reset process to ensure it’s not possible to guess the secret.
- Consider blocking the IP to slow down the attacker.
