A brute-force attack is a method in which an attacker attempts to guess a password, encryption key or other form of access control by trying every possible combination. This method does not require any specific vulnerabilities in the system. Instead, it relies on the attacker simply trying every possible combination of character systematically until the correct value is found. The duration of a brute-force attack depends heavily on the length and complexity of the password, as well as the attacker’s computing power.

Types of brute-force attacks

There are various types of brute-force attacks:

• Simple brute-force attack: All possible character combinations are tested without following a specific strategy. Depending on the password’s length and complexity, this can take a very long time.
• Dictionary attack: The attacker uses a list of commonly used passwords (e.g. ´123456’, ´password´) and tests these against the target.
• Hybrid brute-force attack: A combination of a dictionary and brute-force attack. Common passwords are combined with numbers or special characters to test variations.
• Reverse brute-force attack: Instead of guessing a password, a common password is tested against many usernames to find out which user is using it.
• Credential stuffing: The use of stolen login credentials (username + password) from data breaches to log in to other systems or websites.
   

Protection against brute-force attacks

There are simple and complex measures to protect against brute-force attacks:

• Strong passwords: Use complex, long passwords that contain a mix of upper- and lower-case letters, numbers and special characters. A minimum of 12 characters is recommended.
• Multi-factor authentication (MFA): In addition to the password, a second level of security is introduced, e.g. a one-time code from an app or via text message.
• Account lockout after multiple failed attempts: Locking accounts or delaying further attempts after a set number of failed logins.
• Captcha: Captchas (e.g. ‘I am not a robot’) prevent unwanted attacks by blocking access after a certain number of failed attempts.
• Password manager: A password manager creates and stores complex and unique passwords for each account without the user having to remember them.
• Encryption and salting: Storing passwords in an encrypted form, with ‘salt’ (random data) added to make it more difficult to access passwords in the event of a potential data breach.
• IP address blocking: IP addresses that make multiple failed logins attempts within a short period of time are blocked to prevent brute-force attacks.
• Hashing algorithms: Use computationally intensive, secure hashing algorithms (e.g. bcrypt or Argon2) to store passwords securely, making brute-force attacks take much longer.

Conclusion

Brute-force attacks are a simple yet effective method for hackers to gain access to systems. However, they can be thwarted with a variety of protective measures. The use of strong passwords, multi-factor authentication and additional security features such as Captchas and account locks are essential steps to enhance security and prevent brute-force attacks.

back to the it-glossary