While brute force attacks have been used for a long time, they are rising as people start to work remotely. Before the COVID-19 pandemic, most employees worked in offices with infrastructures that were monitored by security controls.
Now, it's common for employees to access their organizations' networks with their own devices. This poses many security issues because while organizations offer VPN, they don't often force or encourage employees to use it. That makes the company network especially vulnerable to attack - so much so that attackers are starting to use RDP connections as primary vectors for deploying ransomware since it is easily accessible.
What are Brute Force Attacks?
Brute force attacks use the trial-and-error method to guess login info. Brute force attacks are done by trial and error to sooner or later crack the password(s) needed to gain access to whatever is locked.
For example, say someone wants to break into a social media account. All they'd have to do is try every possible combination of usernames/passwords until they stumble upon one that works. Depending on how long or complex the password is, it could take anywhere from seconds to hours, days, months, and even years.
Apart from getting access to personal or organizational details, there are several other ways attackers can benefit from brute force attacks. Some of which include:
- Collecting activity data and getting profit from running ads on reputable websites
- Spreading malware to disrupt systems
- Ruining a website’s reputation
- Hijacking systems for malicious activity
Types of Brute Force Attacks
1. Dictionary attack
A dictionary attack attempts to guess your password based on lists of words and combinations of common passwords you've used in the past. Originally, dictionary attacks relied upon a dictionary and numbers. Still, these days they can include words and entire sentences from leaked word lists that aren't even necessarily paired with passwords - just words that people commonly use in their passwords. These word lists might even be available online or could be bought for a small fee.
2. Credential stuffing
Over the last few years, billions of usernames and passwords have been leaked. These stolen credentials are then sold and used by cybercriminals for various purposes, including spamming and account takeovers.
A credential stuffing attack works by trying to use stolen combinations of login credentials across several sites. Credential stuffing is effective for hackers because people reuse the exact same login details and password combinations. For example, if someone gets access to the company account of a person, they are very likely able to then look into that person's other online bank account as well.
3. Simple brute force attack
A simple brute force attack uses scripts and automation to guess matching passwords. A typical brute force attack makes a few hundred guesses every second, targeting the usual suspects such as lower- and uppercase or common passwords such as 123456 and password.
4. Reverse brute force attack
In a regular brute force attack, the hacker begins with a known hash (pronounced has) and uses automation tools to find the matching password. In simple words, in a reverse brute force attack, a hacker might know the password for someone’s account; he just has to try different permutations and combinations to figure out the username or account details.
5. Hybrid brute force attack
A hybrid brute force attack uses a blend of a brute force attack and a dictionary attack. It features passwords that are four random digits from a year from the user's life. The options are limited to only four numbers because, for example, it could be their birth year or when they graduated from school, etc.
During a reverse brute force attack, the attacker uses the dictionary attack to determine what combinations of words meet these conditions that they have set in advance. This is more efficient than going through all those letters along with a brute force attack, which can take long!
6. Password spraying
Brute force attacks try to figure out your password by trying hundreds or even thousands of variations. Password spraying tries the opposite approach and uses the same password on multiple sites that usually all have the same protocol. This helps avoid being locked out after, say, too many wrong attempts at guessing your password. Typically this type of attack is employed against targets with Single Sign On (SSO) authentication schemes.
7. Botnets
A brute force attack is like a number guessing game, and it takes a lot of computing power to guess numbers on a massive scale. Deploying dozens or even hundreds of computers via Botnets allows attackers to save on the costs and hassle of storing and maintaining their own systems.
Additionally, botnets add an unmatched level of anonymity because each machine in the network can have its own source IP address. Botnets are used in almost all kinds of brute force attacks, so it's best to take steps to prevent them from infecting your SMTP server.
It is crucial to use multifactor authentication, implement IT hygiene, use stronger passwords, and educate your employees and users to safeguard yourself as an individual and your company.
I would like to invite you to try E2E Cloud free for one month: https://bit.ly/3mFerJn
