Brute Force Attack in Hanami with Dynamodb

A brute force attack against a Hanami application backed by DynamoDB typically exploits weak authentication or authorization controls around user sign-in or token verification. In this stack, an attacker may attempt many credential guesses or token values in rapid succession. Because Hanami often uses session-based or token-based auth with DynamoDB as the persistence layer, each guess can translate into legitimate-looking requests to the database layer.

DynamoDB itself does not enforce request-rate limits at the account or table level for unauthenticated callers when the endpoint is exposed via an API gateway or custom route. If the Hanami backend does not enforce strict rate limiting on authentication endpoints, an attacker can issue hundreds or thousands of attempts per minute. DynamoDB’s on-demand capacity can absorb these requests without raising infrastructural alarms, allowing the brute force campaign to proceed while remaining under the radar of basic monitoring.

The risk is compounded when user credentials or one-time codes are stored in DynamoDB without adequate protection. For example, if password verifications are performed by reading an item and comparing hashes in Hanami code rather than using a specialized identity provider, timing differences in DynamoDB read latency can leak information about valid users. Additionally, if the Hanami app uses predictable identifiers (e.g., username or email as the DynamoDB partition key), an attacker can enumerate valid accounts by iterating through likely usernames and observing differences in response behavior, such as 404-like application states versus authentication failures.

Because middleBrick scans the unauthenticated attack surface, it can detect whether authentication endpoints are rate-limited and whether error messages distinguish between missing resources and invalid credentials. Without such controls, the combination of Hanami, DynamoDB, and an exposed API surface creates a viable path for credential stuffing or brute force attacks that may lead to account takeover.

To mitigate brute force risks, implement rate limiting and account enumeration defenses at the Hanami layer, and structure DynamoDB access to avoid leaking information through timing or error patterns.

• Enforce rate limiting on authentication endpoints using a sliding window stored in a fast cache. For example, track attempts per username or IP within a rolling window and reject excess requests before they reach DynamoDB.
• Use constant-time comparison for credentials and avoid branching logic that reveals whether a username exists. Return a generic authentication failure message regardless of whether the user exists or the password is incorrect.
• When designing DynamoDB access patterns, prefer parameterized queries and avoid scanning tables for authentication. Use indexed attributes for predictable lookups and ensure that error handling does not expose stack traces or internal details.

Example Hanami interaction with DynamoDB using the aws-sdk-dynamodb gem, with constant-time verification and no user enumeration:

require "aws-sdk-dynamodb"
require "securerandom"
require "active_support/security_utils"

class UserRepository
  def initialize
    @client = Aws::DynamoDB::Client.new(region: "us-east-1")
    @table = "users"
  end

  # Constant-time authentication check to avoid timing leaks
  def authenticate(username, password_attempt)
    # Fetch a single item by partition key; ensure the response shape is consistent
    begin
      resp = @client.get_item(table_name: @table, key: { user_id: { s: username } })
      item = resp.item
    rescue Aws::DynamoDB::Errors::ServiceError
      # Log the error internally, but return generic failure to avoid information leakage
      return false
    end

    stored_hash = item&.fetch(:password_hash, nil)
    stored_salt  = item&.fetch(:salt, nil)

    # If item not found, still run a dummy hash to keep timing similar
    dummy_hash = ActiveSupport::SecurityUtils.fake_secure_hash
    computed   = password_attempt.hash_with_salt(salt: stored_salt || dummy_salt)

    # Use ActiveSupport::SecurityUtils.secure_compare to avoid timing attacks
    if item && stored_hash && ActiveSupport::SecurityUtils.secure_compare(computed, stored_hash)
      true
    else
      false
    end
  end
end

In this example, secure_compare ensures constant-time string comparison, and the code path for a missing user runs a dummy hash to reduce timing differences. The error handling avoids surfacing whether a username exists, which thwarts enumeration attempts. With these controls, even if DynamoDB is directly reachable via an API, the Hanami application layer prevents attackers from learning valid accounts or accelerating successful guesses.