Config file with no Keys..?

Question

I'm working on a site for someone that doesn't have any keys in the wp-config file. Isn't this a serious issue? I know I can generate these but I wonder if this will have any side-effects..also, is this currently a security risk because the site had been hacked.

Example:

define('AUTH_KEY', 'put your unique phrase here');
define('SECURE_AUTH_KEY', 'put your unique phrase here');
define('LOGGED_IN_KEY', 'put your unique phrase here');
define('NONCE_KEY', 'put your unique phrase here');

Answer 1

It is indeed a security issue to have those left as the defaults, but it is not an extremely serious issue.

To mitigate the problem of known default salts, WordPress intentionally recognizes when those values are left as "put your unique phrase here" and will not use that phrase as a key/salt. Instead, it generates random 64 character salts internally and stores them in the database for usage as salting values. WordPress also ignores any duplicated values across those salts, and generates randoms in those cases too, so any default value used that is identical across them will be rejected as it may potentially known to an attacker.

Now, this is still not ideal, because the salts are then stored in the database. If an attacker happens to get read access to your database, or gets a dump of the database, then they could brute force the hashes and gain further access. But the default values are not used for actual salting.

Ideally, the salts should be defined in the config file, because an attacker would then need to obtain the contents of that file, so reading the database wouldn't get them anything useful.

Note that you can change these values at any time with no serious consequences other than having to log in again, as all the cookies and such will change.

Answer 2

Yes, predictable (or known) keys present a serious security vulnerability.

These keys (salts) are used, for instance, to create a secure cookie for log-in. I explain in more detail in this post, but the upshot is that if the salts are known, then its relatively easy to brute-force the log-in cookie and so get access to the admin.

A conservative estimate on such a brute-force attack is about a week.

_{source: http://codeseekah.com/2012/04/09/why-wordpress-authentication-unique-keys-and-salts-are-important/}