What is a password attack?

A password attack is a typical attack vector used to compromise user account authentication. As one of the most prominent application security concerns, it's responsible for most data breaches worldwide.

Password breaches have far-reaching repercussions. Malevolent users only require illegal access to a single privileged account or a few users' accounts to compromise a web application.

Note: Compromised passwords can open the door for sophisticated attacks such as financial fraud, distributed denial-of-service (DDoS), and the exposure of sensitive information, depending on the data that the application hosts.

Password attacks

Password attacks involve abusing a compromised authorization vulnerability in the system, in combination with automatic password attack tools that accelerate password guessing and cracking.

The attacker employs a variety of tactics to gain access to and reveal an authorized user's credentials, and impersonate their identity and privileges. The username-password combination is one of the oldest known account authentication techniques. Adversaries have had time to devise various approaches for obtaining guessable passwords.

Furthermore, because their vulnerabilities are generally known, applications that rely solely on password authentication are vulnerable to password attacks.

Example

One of the most prevalent password attacks involves attackers convincing the victim that their account will be deactivated if their login credentials aren't verified.

The attacker sends phishing emails to users, alerting them that their account has been compromised and that their credit card and login information are required to keep the account open. The email contains a link that looks identical to the legitimate website, but leads to the hacker's malicious website. When the victim clicks on this link, they are routed to a fake confirmation screen where they enter their valid login credentials. The hacker then steals the victim's credentials and uses them to access their legitimate account.

Types of password attacks

Hackers often utilize various strategies to gain and authenticate with a valid user's password. These include the following:

Phishing attacks

A phishing attack is by far the most common type of password attack. It uses a social engineering approach in which the hacker masquerades as a trustworthy site by giving the victim a malicious link. The victim assumes they are authenticating to a legitimate web server and clicks the link, supplying the attacker with their account details.

Brute-force password attacks

The brute-force attack uses trial-and-error approaches to guess a user's login details. Hackers use automated scripts to run through as many permutations as possible to guess the user's password successfully. While this is an old method that involves a lot of patience and effort, a brute force attack is still used in account breach attempts. This is because it is automated and relatively simple.

Note: Most companies and services try to circumvent brute-force password attacks by limiting failed login attempts, or logins to a specified IP address or range.

Dictionary password attacks

The dictionary password attack technique employs a prepared list of terms most likely to be used as passwords by a given target network. The list is prepared by analyzing a user's behavior patterns and passwords retrieved from prior data breaches. The lists are generated by altering common word combinations by case, adding numeric suffixes and prefixes, and employing common phrases. These lists are then fed into an automated application, which attempts to authenticate against a database of known usernames.

Password spraying attack

In password spraying, the hacker attempts to authenticate using the same password on multiple accounts before resetting the password. This is effective because most website users use easy passwords, and the practice doesn't break lockout regulations because it uses many accounts. Attackers typically orchestrate password spraying on websites where administrators specify a uniform default password for new users and unregistered accounts.

Keylogging

During a keylogging attack, a hacker installs monitoring tools on the user's computer to record the keys the user presses secretly. A keylogger collects all information that users enter into input fields, and transfers it to a malicious third party. While keyloggers are often used in workplace settings, attackers utilize them maliciously to acquire information such as login credentials for unauthorized access.

Prevention

Some best practices to avoid password attacks are as follows:

• Enforcing strong password policies

• Enabling multi-factor authentication

• Providing training on password security awareness

• Using password managers

Hackers are always in search of adopting new technologies to attempt password attacks. For this purpose, users must strictly enforce prevention measures to avoid becoming victims of such attacks.