Password reset token bruteforce
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detect excessive password reset requests for a user.
This may be caused by a malicious actor trying to guess the right password reset token for this user.
Required business logic events
Datadog auto-instruments many event types. Review your instrumented business logic events. This detection requires the following instrumented event:
Strategy
Count the number of password reset attempts for a given user.
Requires the password reset to be flagged using a user event with a usr.login metadata field set to the user receiving the password reset.
The instrumentation should be added on the route processing the password reset request (instead of the one sending the email with the password reset link).
usr.login must be provided and unique, even if the user does not exist.
A Medium signal is then generated if more than 10 password resets for a single user over 5 minutes are found.
Triage and response
- Investigate the IP activity and validate that it is legitimate.
- Review your password reset process to ensure it’s not possible to guess the secret.
- Consider blocking the IP to slow down the attacker.
