Password Attacks Flashcards
Replay attack
A replay attack is a form of network-based cyberattack where an attacker intercepts and maliciously retransmits data packets that were previously recorded during a legitimate communication session. By capturing and replaying these packets, the attacker aims to deceive the target system into accepting and processing the duplicated data, which can lead to unauthorized access, data corruption, or other security breaches.
How to Defend: To mitigate replay attacks, security measures such as message authentication codes (MACs), timestamps, and session tokens are often used to verify the integrity and freshness of transmitted data.
Dictionary Attack
A dictionary attack is a type of password-cracking technique where an attacker systematically attempts to guess or crack passwords by testing a large number of common words or phrases from a precompiled list, known as a dictionary. This method exploits the fact that many users choose weak or easily guessable passwords based on dictionary words, common phrases, or patterns.
How to Defend: To counter dictionary attacks, users are advised to use strong and complex passwords that include a combination of uppercase and lowercase letters, numbers, and special characters, and to avoid using easily guessable words or phrases.
Spraying Attack
A spraying attack, also known as password spraying, is a brute-force attack technique used by cybercriminals to gain unauthorized access to multiple user accounts or systems by systematically trying a few commonly used passwords against a large number of usernames or accounts.
Unlike traditional brute-force attacks, which attempt to guess a single password for a specific user account, spraying attacks involve trying a small set of passwords across a wide range of accounts, increasing the likelihood of success.
How to Defend: To defend against spraying attacks, organizations should enforce strong password policies, implement account lockout mechanisms, and monitor for unusual login attempts or patterns.
Birthday attack
A birthday attack is a cryptographic attack that exploits the birthday paradox, which states that in a set of randomly chosen people, there is a high probability that at least two people will share the same birthday. In the context of cryptography, a birthday attack leverages this principle to find collisions in hash functions, where two different inputs produce the same hash value.
By generating a large number of hash values and comparing them, an attacker can exploit the birthday paradox to find collisions more efficiently than by brute-force methods. Birthday attacks are particularly relevant in the context of cryptographic protocols such as digital signatures, where collisions can lead to security vulnerabilities.
How to Defend: To mitigate birthday attacks, cryptographic algorithms should use sufficiently large hash sizes to minimize the likelihood of collisions.
True/False
One of the measures for bypassing the failed logon attempt account lockout policy is to capture any relevant data that might contain the password and then attempt to brute force it offline.
True. An attacker can capture encrypted or hashed passwords from intercepted network traffic or compromised databases and then attempt to crack them using powerful offline brute-force techniques. By doing so, attackers can avoid triggering the account lockout policy, as they are not making repeated failed login attempts directly against the target system. This highlights the importance of implementing strong encryption, secure password storage practices, and network security measures to protect against such attacks.
Rainbow tables
Rainbow tables are precomputed tables used in password cracking to quickly reverse cryptographic hash functions and recover plaintext passwords from hashed passwords.
When passwords are stored by systems, they are often hashed, which means they’re transformed into a fixed-length string of characters using a mathematical algorithm. This process is meant to protect passwords, as even if attackers gain access to the hashed passwords, it’s difficult to reverse the process and obtain the original plaintext password.
However, rainbow tables take advantage of the fact that many users choose weak passwords, and that hashing algorithms always produce the same hash for the same input. Rainbow tables store precomputed hashes for a large number of possible passwords. These tables allow attackers to quickly look up the hash of a captured password and find the corresponding plaintext password, significantly speeding up the cracking process.
How to Defend: To mitigate the effectiveness of rainbow table attacks, security measures such as salting and using strong, slow hashing algorithms (like bcrypt or scrypt) are employed. Salting involves adding a unique random value (the salt) to each password before hashing, ensuring that even if two users have the same password, their hashed passwords will be different. This complicates the use of rainbow tables, as attackers would need to create separate tables for each possible salt value. Additionally, using slow hashing algorithms makes the hashing process computationally expensive, slowing down the password cracking process even further.
