Broken Authentication and Insecure Deserialization

Broken authentication refers to weaknesses in how an application verifies user identity and manages sessions. When authentication is broken, attackers can compromise passwords, keys, or session tokens to assume other users' identities. This OWASP Top 10 category covers a wide range of flaws: weak credentials, poor session management, missing MFA, and insecure credential storage.

Credential stuffing uses large lists of breached username/password pairs from prior data breaches and tries them against other sites, exploiting password reuse. Password spraying takes the opposite approach: try a small set of common passwords (e.g., Password1!) against many accounts to avoid account lockout thresholds. Both attacks succeed because of weak password policies and lack of MFA.

Sessions connect authenticated users to their application state. Weak session management flaws include: predictable session token values (sequential IDs that attackers can guess), tokens that never expire, tokens transmitted over HTTP instead of HTTPS, and failure to invalidate tokens on logout. An attacker who obtains a valid session token can impersonate the user without knowing their password.

Session fixation forces a victim to use a session ID chosen by the attacker. For example, an attacker sends a link with a pre-set session cookie; after the victim authenticates, the attacker uses that same session ID to access the account. Session hijacking steals an existing session token via XSS, network sniffing (on unencrypted connections), or stolen cookies. The fix: regenerate session IDs after login and use HTTPS everywhere.

Storing passwords in plaintext or with weak hashing (MD5, SHA-1) is a critical authentication failure. When a database is breached, plaintext passwords and weak hashes are immediately usable. Secure password storage requires an adaptive hashing algorithm designed for passwords: bcrypt, Argon2, or PBKDF2 with a random per-user salt. These algorithms are intentionally slow, making offline cracking computationally expensive.

Serialization converts an object's state to a format (JSON, XML, binary) for storage or transmission. Deserialization reconstructs the object from that format. Insecure deserialization occurs when an application deserializes attacker-controlled data without validation — allowing attackers to modify serialized objects to manipulate application logic, escalate privileges, or execute arbitrary code on the server.

A common attack pattern involves serialized objects passed in cookies or API parameters. For example, a Java application using ObjectInputStream.readObject() on untrusted data can trigger Remote Code Execution (RCE) through gadget chains in popular libraries (Apache Commons Collections). The attacker crafts a malicious serialized payload, sends it to the application, and code executes during deserialization — often before any authentication check runs.

Defenses against insecure deserialization include: never deserializing untrusted data with dangerous formats like Java native serialization or Python pickle. Prefer data-only formats (JSON, XML) over binary serialization. If deserialization is required, implement integrity checks (signing the serialized object with HMAC), use allow-lists to restrict which classes may be deserialized, and run deserialization code in isolated, low-privilege environments.

Multi-Factor Authentication (MFA) is the most impactful single control against broken authentication. Even if credentials are compromised through phishing, credential stuffing, or a database breach, an attacker without the second factor cannot authenticate. Microsoft reports that MFA blocks over 99.9% of automated account compromise attacks. MFA should be mandatory for privileged accounts and encouraged for all users.

Account lockout policies temporarily disable an account after a defined number of failed login attempts, slowing brute-force attacks. However, lockouts can enable denial of service against legitimate users — attackers intentionally trigger lockouts to prevent access. Rate limiting (slowing responses after repeated failures using exponential backoff) and CAPTCHA challenges mitigate brute force with less DoS risk.

OWASP lists Broken Authentication as a critical risk because authentication flaws are both common and high-impact. Key indicators of broken authentication include: permitting automated attacks such as credential stuffing, permitting brute force or other automated attacks, permitting default, weak, or well-known passwords, using weak credential recovery processes, using plain text or weakly hashed passwords, and missing or ineffective multi-factor authentication.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: broken authentication includes weak sessions, credential stuffing, and insecure password storage, insecure deserialization can lead to Remote Code Execution via malicious serialized objects, and MFA, bcrypt password hashing, session regeneration after login, and signed serialized data are key defenses. Next up we explore secure SDLC, SAST, and DAST tools.