Password Spray Attack: A New Method of Getting Your Password

Most cybersecurity professionals know and understand the traditional attacks on passwords (i.e. brute force, dictionary, keylogger, etc.) but for the most part, those of us outside of the pen-testing community, when we think of password attacks we think about taking one userid and brute-forcing it with thousands of passwords. The problem with this particular attack method is that this would quickly lock out accounts and almost certainly set off a bunch of bells and whistles to the security team alerting them to an attacker's presence on their network. Well, it seems that the bad guys (and the pen-testing community as well) figured this out a long time ago and they now have a new favorite attack on passwords. Instead of brute-forcing passwords they now prefer to execute what is called a password spray attack. 

Password Spray Attack is quite the opposite of Brute Force Attack. In Brute Force attacks, hackers choose a vulnerable ID and enter passwords one after another hoping some password might let them in. Basically, Brute Force is many passwords applied to just one ID.

Coming to Password Spray attacks, there is one password applied to multiple user IDs so that at least one of the user ID is compromised. For Password Spray attacks, hackers collect multiple user IDs using social engineering or otherphishing methods. It often happens that at least one of those users is using a simple password like 12345678 or evenp@ssw0rd. This vulnerability (or lack of info on how to create strong passwords) is exploited in Password Spray Attacks.

In a Password Spray Attack, the hacker would apply a carefully constructed password for all the user IDs he or she has collected. If lucky, the hacker might gain access to one account from where s/he can further penetrate into the computer network.

Password Spray Attack can thus be defined as applying the same password to multiple user accounts in an organization to secure unauthorized access to one of those accounts.

May be you might ask yourself on how does this differ from Brute force attack, well the problem with Brute Force Attacks is that systems can be locked down after a certain number of attempts with different passwords. For example, if you set up the server to accept only three attempts otherwise lock down the system where login is taking place, the system will lock down for just three invalid password entries. Some organizations allow three while others allow up to ten invalid attempts. Many websites use this locking method these days. This precaution is a problem with Brute Force Attacks as the system lockdown will alert the administrators about the attack.

To circumvent that, the idea of collecting user IDs and applying probable passwords to them was created. With Password Spray Attack too, certain precautions are practiced by the hackers. For example, if they tried to apply password1 to all the user accounts, they will not start applying password2 to those accounts soon after finishing the first round. They’ll leave a period of at least 30 minutes among hacking attempts.

Up to now there no guaranteed way to secure yourself but there are some suggestions by the researchers 

Post a Comment