Weak Cryptography

What it is

Weak cryptography vulnerabilities arise from using broken or weak algorithms (MD5, SHA1, DES, RC4), incorrect cipher modes (ECB), short key sizes, hardcoded keys, predictable IVs, or improper random number generation. These flaws can allow attackers to crack passwords, decrypt encrypted data, forge signatures, or predict secrets.

Attack Vectors

• Password hashing (MD5/SHA1 without salt)
• Data encryption at rest and in transit
• Token and session ID generation
• Digital signature and certificate validation
• Cryptographic random number generation

Testing Methodology

1. Identify cryptographic algorithms used (examine source, error messages, cipher suites)
2. Test TLS configuration with sslyze or testssl.sh
3. Check for MD5/SHA1 in password hashes — crack with hashcat
4. Identify ECB mode (identical blocks produce identical ciphertext)
5. Test for predictable session tokens by collecting samples

Indicators of Vulnerability

• Password hashes cracked with common wordlists (MD5/SHA1)
• Identical ciphertext blocks for identical plaintext (ECB mode)
• TLS scanner reports SWEET32, POODLE, BEAST, CRIME vulnerabilities

Detection Guidance

Audit cryptographic library usage. Run TLS configuration scanners. Check password hashing algorithms in source code and database schemas.

Mitigation & Remediation

• Use modern password hashing algorithms: bcrypt, Argon2, or scrypt
• Use AES-GCM or ChaCha20-Poly1305 for symmetric encryption
• Use RSA-2048+, ECDSA with P-256+, or Ed25519 for asymmetric operations
• Configure TLS 1.2+ with strong cipher suites only
• Use a cryptographically secure random number generator for all secrets

References

• OWASP Cryptographic Failures
• OWASP Cryptographic Storage Cheat Sheet
• OWASP Hunting — Weak Cryptography (upstream)