bitwarden: add slow-bf scenario using new time helpers #1565
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Reduce bitwarden-bf capacity from 5 to 3 for faster detection - Add new crowdsecurity/bitwarden-slow-bf conditional scenario - Detects 3 failed logins over 2-30 minute intervals using MedianInterval helper - Catches attackers who deliberately slow their attempts to evade rate limiting - Add slow-bf scenario to bitwarden collection
…y change - Add new test for crowdsecurity/bitwarden-slow-bf scenario - Tests 3 failed logins over 2-20 minute intervals - Verifies MedianInterval detection logic works correctly - Update bitwarden-bf assertions for reduced capacity (5->3) - Now triggers after 3 failures instead of 5
- Remove upper bound from MedianInterval check (leakspeed naturally caps it) - Keep lower bound at 2m (no slow-bf variant for bitwarden to overlap with) - Update documentation to clarify leakspeed naturally caps maximum interval - Regenerate test assertions - All tests passing
- Restore original capacity of 5 in bitwarden-bf scenario - Update documentation to reflect capacity 5 - Regenerate test assertions for capacity 5 behavior
Member
Author
updated from the conversation we had this morning, @blotus can you check the slow variant, instead of creating our older leaky with higher capacity and leakspeed. using the median interval. |
LaurenceJJones
changed the title
- Update markdown to reference correct capacity 5 for standard bitwarden-bf - Adjust timing description to ~100 seconds (5 failures × 20s leakspeed)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Checklist