Comprehensive Brute Force Attack Methods and Risks

Brute Force defines the process of guessing over predetermined password sets to gain unauthorized access to user accounts of the target system in cases where the attackers do not have password information or only password hashes. An attacker may try to guess the password using a repetitive or repetitive mechanism in Brute Force attacks. Brute Force attacks usually interact with a service (usually the application in which the account resides) to check the validity of accounts.

1. Password Spraying
Attacks
Threat Intelligence Team
13.06.2022
TR29042022PS
Author: Threat Intelligence Team
R
elease Date: 13.06.2022
Report ID: TR29042022PS

2. 2
What’s Brute Force
BruteForcedefinestheprocessofguessingoverpredeterminedpasswordsetsto
gainunauthorizedaccesstouseraccountsofthetargetsystemincaseswherethe
attackersdonothavepasswordinformationoronlypasswordhashes.Anattacker
maytrytoguessthepasswordusingarepetitiveorrepetitivemechanisminBrute
Forceattacks.BruteForceattacksusuallyinteractwithaservice(usuallythe
applicationinwhichtheaccountresides)tocheckthevalidityofaccounts.
Password Spraying Attacks
What's Password Spraying?
Intherecentpast,attackersusedtoperformtraditionalBruteForceattacksby
attemptingtologintoasingleaccountusingmultiplepasswords.However,dueto
thedisadvantagesofthismethod,attackersoftenpreferthePasswordSpraying
technique,whichtheythinkismoreeffective.
Passwordsprayingisabruteforceattackinwhichanattackerattemptstogain
accesstomultipleaccountsbyusingacommon password.Thistypeofattackis
oftenusedwhenbruteforcingasingleaccountwouldbetootimeconsuming,orif
theattackerdoesnothaveenoughinformationaboutthetargetaccount.
AnotherreasonattackerspreferthePasswordSprayingtechniqueisthatit
preventsunsuccessfulattackattemptsthatresultinalargenumberoffalselogin
attemptsinashorttime,causinganalarmbybeingcaughtinthesecuritycheckor
warningtheuserbysuspendingthecurrentaccount.Sinceadversariesoftenuse
BruteForceatthestageofobtainingFirstAccesstothesystem,whichisoneofthe
firststepsofanattackchain,failureatthebeginningoftheattackisasituationthat
attackersdonotwant.
How does it work?
AcquireListofUsernames
TocarryoutsuccessfulPasswordSprayingattacks,theattackermustfirsthavea
passwordlistgeneratedaccordingtothepasswordpolicyofthetargetforwhich
theywanttoobtainvalidaccounts.Inaddition,theattackercanobtaintheselists
fromadatabreachinvolvingidentityinformationsuchasusernameandpassword.
Attackersneedtoapplytheexistingpasswordlisttospecifictargets.Forthis,they
alsohavetodeterminetheirusername (email).Mostcompanieshavea
standardizedemailnamingscheme,suchasfirstname_lastname@company .com.
TheseusernamelistscanbesoldonDarkWebmarkets.Sometimes,usernamesand
correspondingemailaddressesareeasilyaccessiblefromthecompanysiteor
employeesocialmediaprofiles.

3. 3
BeginSprayingPasswords
Inapasswordsprayingattack,theattackerwilltryasinglepasswordagainst
multipleaccounts.Thisisincontrasttoatraditionalbruteforceattack,wherethe
attackerwouldtrymultiplepasswordsagainstasingleaccount.
Oneofthereasonswhythistypeofattackcanbesuccessfulisthatmanypeople
usethesamepasswordformultipleaccounts.Thismeansthatiftheattackercan
findjustoneaccountthatusesthecommon password,theycanthenusethat
passwordtotryandbruteforceotheraccounts.
GainAccount&SystemAccess
SupposetheattackerobtainstheaccountbyperformingasuccessfulPassword
Sprayingattackagainstanemployeewhodoesnotcomplywiththecompany's
passwordpolicy.Inthatcase,theymayhavethefollowinggains.
•Itwillhaveaccesstoallnetworksandserviceswithintheaccountholder's
authority.
•BecausethehackedaccountwillbeinValidAccountsstatus,itcanbypass
existingsecuritychecks.
•Aslongastheuseraccountisregistered,itwillhaveafootholdforpersistenceon
thetargetsystem.
•Anattackercanthenusethisaccesstomakeinternalnetworkdiscoveries,target
deepernetworks,orgainaccesstootheraccountswithelevatedprivileges.
Password Spraying Attacks
Mitigations
Youcanfollowthesuggestionsbelowtomitigateorpreventtheimpactof
PasswordSprayingattacks.
•Usestrongpasswordsthatareuniquetoeachaccount
•Implementaccountlockoutpolicies
•Usetwo-factorauthentication
•Monitorloginactivityforsuspiciousbehavior