Man in the middle attack
One of the possible attacks on ABRA Flexi is a Man In The Middle Attack, where an attacker impersonates ABRA Flexi servers and the user provides them with authorization credentials, which the attacker can then use to authenticate against the real servers and analyze the communication flow.
By default, ABRA Flexi generates a so-called Self-Signed Certificate. The SSL certificate can be replaced.
To prevent this, ABRA Flexi includes several features that eliminate this issue:
On startup, ABRA Flexi downloads the certificate and verifies it during communication with the server. Therefore, it is not possible to replace the certificate at runtime.
DANE – storing the certificate in DNS
$ ./swede --insecure create --port 5434 --certificate certifikat.pem --selector 1 --output rfc demo.flexibee.eu _5434._tcp.demo.flexibee.eu. IN TLSA 1 0 1 85b928d1cab396d8e632d15d57b3a97ebbc2769ab74a292040dc4fc340153973
Instead of the SWEDE tool, it is also possible to retrieve the configuration from a running ABRA Flexi server at the address /certificate/tlsa.
The following record is then added to DNS:
_5434._tcp.demo.flexibee.eu. IN TXT TLSA 1 0 1 85b928d1cab396d8e632d15d57b3a97ebbc2769ab74a292040dc4fc340153973
That is, the entire value stored is "TLSA 1 0 1 85b928d1cab396d8e632d15d57b3a97ebbc2769ab74a292040dc4fc340153973"
The lookup is performed in the following order:
5434._tcp.demo.flexibee.eu. _tcp.demo.flexibee.eu. 5434._tcp.flexibee.eu. _tcp.flexibee.eu.
Note: if you are not also using DNSSec, the security of the DNS server response is not guaranteed.
Note: the ABRA Flexi client currently does not support full DANE, but only the following parameters: –selector 1, –mtype 1, –usage 0
CSRF
ABRA Flexi has built-in protection against Cross-Site Request Forgery, and no configuration is required in this regard.
SQL Injection and XSS
During the design process, we invested significant effort to prevent SQL Injection and Cross-Site Scripting (XSS). As a result, these types of vulnerabilities do not occur.
Password Storage
Previously, ABRA Flexi used MD5 encryption for storing passwords. SHA256 is now used along with salting. Old passwords are re-encoded only when changed.