What Brute-Force Attacks Are and How to Reduce Password Risks
Summary
An explainer describes brute-force methods, examples of their use, and password risks, then recommends protections including unique, strong passwords, MFA, login limits, account lockouts, and monitoring.
Key points
- Brute-force attacks try password combinations or reuse known and leaked credentials to gain account access.
- Methods discussed include simple, dictionary, hybrid, reverse brute-force, credential stuffing, and rainbow table attacks.
- DarkOwl reports finding over 102 million passwords in its dataset formatted as yyyy-mm-dd, and more than 13,000 formatted as yyyy/mm/dd.
- The article cites reported incidents involving account hijacking in Ukraine, attacks against organizations in 45 countries, and brute-force attempts against VPN, web, and SSH services.
- The article recommends MFA, strong unique passwords, login-attempt limits, account lockouts, CAPTCHA, and monitoring frequent login attempts.
- It advises using passwords of at least 16 characters and avoiding dates, dictionary words, reused passwords, and sequential numbers.
Article Details
- Topic
- Brute-force attacks, password-cracking methods, observed use in cyber incidents, and defensive measures.
MITRE ATT&CK
T1110 · Brute ForceBrute-force attacks are the article’s central subject and are described across several examples.T1110.001 · Password GuessingThe article describes guessing passwords against email accounts and other services.T1110.004 · Credential StuffingCredential stuffing is described as testing exposed email and password pairs against commercial websites.T1566 · PhishingThe article reports that LanceFly used phishing emails among its methods.
Threat Actors
Earth KrahangNamed in the article as the group behind a Chinese state-sponsored campaign that targeted government organizations and brute-forced email accounts.LanceFlyNamed APT group reported to have used SSH credential brute forcing and phishing while targeting organizations in South and Southeast Asia.