摘要
对目前广泛应用的PhpBB网络论坛的安全性进行了研究,详细分析了该类论坛程序中有关用户密码安全机制的全部过程,包括注册时密码检测,密码加密函数及后台数据库存储格式,用户登录验证等。研究发现,该类论坛的早期版本的安全性较弱,而后期3.0版本之后虽然提供了强度较高的密码加密算法,但实际中为了保证兼容性给论坛留下了潜在的安全隐患。针对这些弱点,设计了相应的攻击方法,同时也提出了应对这些攻击的保护措施。
The security of PhpBB forum is discussed,the whole process of security scheme related to the user’s password in this kind of forum analyzed,including password checking in registration,storage of password in database and the user’s logging in.The study indicates that the earlier version is weak in security,and the subsequent 3.0 version could provide more secure cryptographic algorithm.However,for ensuring the compatibility in practice,the potential security threat is also left to the forum.Aiming at this vulnerability,the countermeasures in dealing with these corresponding attacks are proposed in this paper.
出处
《通信技术》
2013年第8期98-101,共4页
Communications Technology
关键词
PhpBB论坛
安全分析
密码算法
PhpBB forum
security analysis
cryptographic algorithm
