CAPEC-49 Password Brute Forcing

An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password.

A system will be particularly vulnerable to this type of an attack if it does not have a proper enforcement mechanism in place to ensure that passwords selected by users are strong passwords that comply with an adequate password policy. In practice a pure brute force attack on passwords is rarely used, unless the password is suspected to be weak. Other password cracking methods exist that are far more effective (e.g. dictionary attacks, rainbow tables, etc.). Knowing the password policy on the system can make a brute force attack more efficient. For instance, if the policy states that all passwords must be of a certain level, there is no need to check smaller candidates.

1. [Explore] [Determine application's/system's password policy] Determine the password policies of the target application/system. 2. [Exploit] [Brute force password] Given the finite space of possible passwords dictated by the password policy determined in the previous step, try all possible passwords for a known user ID until application/system grants access.

• An adversary needs to know a username to target. • The system uses password based authentication as the one factor authentication mechanism. • An application does not have a password throttling mechanism in place. A good password throttling mechanism will make it almost impossible computationally to brute force a password as it may either lock out the user after a certain number of incorrect attempts or introduce time out periods. Both of these would make a brute force attack impractical.

• [Low] A brute force attack is very straightforward. A variety of password cracking tools are widely available.

• Confidentiality, Access Control, Authorization: Gain Privileges • Confidentiality: Read Data • Integrity: Modify Data

• Implement a password throttling mechanism. This mechanism should take into account both the IP address and the log in name of the user. • Put together a strong password policy and make sure that all user created passwords comply with it. Alternatively automatically generate strong passwords for users. • Passwords need to be recycled to prevent aging, that is every once in a while a new password must be chosen.