Question

Question 1. The following code asks the user to enter the password and check it with the pre-defined password that stored in the system. If the entered password is correct, it will authenticate the user to log-in into the account, otherwise reject!

1. Analyze the following code, how it works?
2. Do you think this code is safe? Justify?
3. Try to overwrite this code and report the outputs?
4. Define any vulnerabilities in this code if exist?
5. What we can do to make this code more secure? Justify by writing a secure version of this code.

#include <stdio.h>

#include <string.h>

#include <stdbool.h>

int main(void)

{

    char buff[8];

    bool pass = true ;

    printf("\n Enter the password : \n");

    gets(buff);

        if(strcmp(buff, "admin") ==0)

    {

        printf ("\n Correct Password \n");

        pass = true;

    }

    else

    {

        printf ("\n Wrong Password \n");

        pass = false;

        

    }

    if(pass)

    {

       /* authorized the user*/

        printf ("\n Permission is given to the user \n");

    }

    return 0;

}

Answer 1

a.

In the given code, firstly the system prompts the user to enter the password.

It then waits for the user to enter the password and press the enter key in the keyboard, the entered string is stored in the 'buff' array.

Then the string entered by the user is compared with "admin", using the strcmp() function.

If the comparison results in identical strings, then the strcmp() function returns 0, else it returns a non-zero value.

If 0 is returned, then message is displayed as "Correct Password", and the value of the boolean variable 'pass' is set to true.

If 1 is returned, then the message is displayed as "Wrong Password", and the value of variable 'pass' is set to false.

Now, only if the value of the variable 'pass' is true, then the message "Permission is given to the user" is displayed.

In this way, the code works.

b.

The code is not safe, because this code restricts the password to be only 8 characters. Now even though 8 characters are more than enough for a strong password, still that acts as a restriction in the code.

Also, the password is set to "admin". Now, whoever may be the user, the password will be same for all as "admin".

Had it asked for the username also, then it would had been an additional security.

c.

The code can be overwritten as follows:

#include <stdio.h>

#include <string.h>

#include <stdbool.h>

int main(void)

{

    char buff[8];

    printf("\n Enter the password : \n");

    gets(buff);

        if(strcmp(buff, "admin") ==0)

    {

        printf ("\n Correct Password \n");

/* authorized the user*/

        printf ("\n Permission is given to the user \n");

    }

    else

    {

        printf ("\n Wrong Password \n");

        pass = false;

    }

return 0;

}

d.

The most important vulnerability in the code is the fact any user can access the system with the same password. And also, the limitation to the length of password adds to the vulnerability list. Even if the user tries to enter more than 8 characters, still only the first 8 characters will be taken and compared, and anyways will lead to wrong password message.

e.

The code can be made more secured, if there are different username and different passwords for different users.

An example for three different users can be as follows. But still using a database would be a better option. Still making the given code more secure will be as follows:

int main(void)

{

    char buff[8],username[8];

   

printf("\n Enter the username : \n");

    gets(username);

printf("\n Enter the password : \n");

    gets(buff);

        if((strcmp(username,"user1")&&strcmp(buff, "admin1") ==0)||(strcmp(username,"user2")&&strcmp(buff, "admin2") ==0)||(strcmp(username,"user3")&&strcmp(buff, "admin3") ==0))

    {

        printf ("\n Correct Password \n");

/* authorized the user*/

        printf ("\n Permission is given to the user \n");

    }

    else

    {

        printf ("\n Wrong Password \n");

        pass = false;

    }

return 0;

}