Types of Password attacks and how to stop them?

Table of Contents

• Introduction
• Phishing
• Man-in-the-Middle Attack
• Brute Force Attack
• Dictionary Attack
• Credential Stuffing
• Keyloggers
• Traffic Interception
• Preventing Password Attacks

Introduction

A password assault is a typical method of bypassing or exploiting user account authentication. Password attacks were one of the most prominent application security concerns in 2020, accounting for more than 81 percent of data breaches. This article illustrates what a password attack is, the many sorts of assaults, and how to avoid them in modern applications. Password assaults combine leveraging a system’s broken authorization vulnerability with automatic password attack tools that speed up password guessing and cracking.

The attacker utilizes a variety of tactics to gain access to and reveal a genuine user’s credentials, assuming their identity and privileges. Because the username-password combination is one of the oldest known account authentication systems, attackers have had plenty of time to devise a variety of methods for obtaining guessable passwords. Furthermore, applications that rely solely on passwords for authentication are vulnerable to password attacks because the flaws are well-known.

Because malevolent users only need illegal access to a single privileged account or a few users’ accounts to compromise the online application, password attacks have far-reaching implications. Compromised credentials can lead to the exposing of sensitive information, distributed denial-of-service attacks, financial fraud, and other complex attacks, depending on the data held by the application.

Phishing

Phishing occurs when a hacker poses as a trustworthy party and sends you a phony email in the hopes that you will voluntarily divulge your personal information. They may take you to a false “reset your password” screen, or they may download harmful code to your device. On the OneLogin blog, we highlight a few cases.

Here are a few phishing examples:

Regular phishing: You receive an email from what appears to be goodwebsite.com asking you to reset your password, but you didn’t read the email carefully and it is goodwobsite.com. The hacker steals your credentials after you “changed your password.”

Spear phishing: A hacker sends you an email that looks like it came from a friend, colleague, or associate. It has a short, generic message (“Please review the invoice I included and let me know if it makes sense.”) and hopes you will open the malicious attachment.

Smishing and vishing: A hacker sends you a text message (smishing) or a phone call (voice phishing, or vishing) informing you that your account has been frozen or that fraud has been found. The hacker grabs your account information after you enter it.

Whaling: You or your employer get an email purporting to be from a senior executive. You submit crucial information to a hacker since you didn’t do your homework on the email’s validity.

Follow these steps to avoid phishing attacks,

• Check who sent the email: Check the From, line of each email to be sure the person they claim to matches the email address you anticipate.
• Double-check with the source: When in doubt, contact the person who sent the email to confirm that they were the one who sent it.
• Check-in with your IT team: The IT staff at your company can usually inform you if the email you received is real.

Man-in-the-Middle Attack

Man-in-the-middle (MitM) attacks occur when a hacker or compromised system sits between two uncompromised persons or systems and decodes the information they’re exchanging, including passwords. In class, Jeremy gets the opportunity to be the man in the middle if Alice and Bob are passing notes and Jeremy needs to relay those notes. Equifax pulled its apps from the App Store and Google Play store in 2017 because they were sending critical data via unsecured networks, allowing hackers to steal consumer data.

To assist against man-in-the-middle attacks, follow these steps:

• Enable encryption on your router. If anyone on the street has access to your modem and router, they can use “sniffer” equipment to see the data that passes through it.
• Use strong credentials and two-factor authentication. The default login and password for many routers are never changed. If a hacker gains access to your router’s admin panel, they can divert all of your traffic to their compromised servers.
• Use a VPN. By guaranteeing that all of the servers to which you send data are trustworthy, a secure virtual private network (VPN) can help prevent man-in-the-middle attacks.

Brute Force Attack

A brute force attack is a battering ram if a password is equivalent to using a key to access a door. In 22 seconds, a hacker can test 2.18 trillion password/username combinations, and if your password is simple, your account may be targeted.

To aid in the prevention of brute force attacks:

• Make your password difficult to guess. An all-lowercase, all-alphabetic, six-digit password is vastly different from a mixed case, mixed-character, ten-digit password.
• The likelihood of a successful brute force assault diminishes as the complexity of your password grows.
• Configure and enable remote access.
• If your organization implements remote access management, inquire with your IT department.
• A brute-force assault can be mitigated by using an access management tool like One Login.
• Make multi-factor authentication mandatory. If your account has multi-factor authentication (MFA), a potential hacker can only gain access to your account by sending a request to your second factor.
• Because hackers are unlikely to get access to your mobile device or fingerprint, they will be unable to access your account.

Dictionary Attack

Dictionary assaults are a form of brute force attack that relies on the human tendency of using “simple” words as passwords, which hackers have compiled into “cracking dictionaries.” More complex dictionary attacks include words that are personal to you, such as your hometown, child’s name, or pet’s name.

To help prevent a dictionary attack, do the following:

• Never use a password that is a dictionary word. It should never be part of your password if you’ve read it in a book.
• Consider utilizing a password management system if you must use a password instead of an access management solution.
• Accounts are locked, after a certain number of password failures.
• It might be unpleasant to be locked out of your account when you forget your password, but the alternative is typically account insecurity.
• Before your application instructs you to chill down, give yourself five or fewer trials.
• Think about getting a password manager.
• Password managers generate complex passwords for you, which helps you avoid dictionary attacks.

Credential Stuffing

If you’ve ever been hacked, you know that your old passwords were most likely dumped onto a malicious website. Accounts that have never had their passwords reset after a break-in are vulnerable to credential stuffing. Hackers will try a variety of previous usernames and passwords in the hopes that the victim hasn’t updated them.

To avoid credential stuffing, follow these steps:

• Keep an eye on your accounts.
• You can pay for services that monitor your online identities, but you can also utilize free sites like haveIbeenpwned.com to see if your email address has been linked to any recent data breaches.
• Change your passwords frequently.
• The longer a password remains unchanged, the more likely it is that it will be cracked by a hacker.
• Consider using a password manager. Many credential stuffing attacks, such as dictionary assaults, can be avoided by using a strong and secure password.
• A password manager can assist with this.

Keyloggers

Key loggers are malicious programs that record every keystroke and send the information to a hacker. A consumer will typically download the software believing it to be authentic, only to have it install a key logger without their knowledge.

To avoid key loggers, follow these steps:

• Examine your physical equipment. If someone has physical access to your computer, a hardware key logger can be installed to record your keystrokes.
• Regularly inspect your computer and the area around it to verify that you are familiar with all of the hardware.
• Scan your computer for viruses. Scanning your computer with good antivirus software regularly is recommended.
• Antivirus firms keep track of the most frequent malware key loggers. It also warns them as potentially harmful.

Traffic Interception

Threat actors eavesdrop on network traffic to monitor and grab data through traffic interception, a variation on the man-in-the-middle assault. Unsecured Wi-Fi connections or connections that don’t use encryption, such as HTTP, are a frequent technique to do this.

SSL traffic is also vulnerable. For example, in SSL hijacking, a hacker can utilize a man-in-the-middle attack. When a user attempts to connect to a secure website, the attacker constructs a sort of bridge between the user and the intended destination, intercepting any information flowing between the two, including passwords.

Preventing Password Attacks

The best approach to avoid password assault is to avoid it altogether. Inquire with your IT professional about establishing a shared security policy that includes:

Multi-factor authentication. Authenticating Users with a physical token (such as a Yubikey) or a personal device (such as a smartphone) ensures that passwords aren’t the only way in.

Remote access. When implementing a smart remote access platform like OneLogin, individual websites are no longer a source of user confidence. Instead, before enabling a person to log in, One Login confirms their identity.

Biometrics. It will be extremely difficult for a bad actor to duplicate your fingerprint or facial form. When you use biometric authentication, your password is just one of several sources of trust that a hacker must overcome.