Detail CAPEC-565

Alur Eksekusi

[Determine target's password policy] Determine the password policies of the target system/application.

• Determine minimum and maximum allowed password lengths.
• Determine format of allowed passwords (whether they are required or allowed to contain numbers, special characters, etc., or whether they are allowed to contain words from the dictionary).
• Determine account lockout policy (a strict account lockout policy will prevent brute force attacks).

[Select passwords] Pick the passwords to be used in the attack (e.g. commonly used passwords, passwords tailored to individual users, etc.)

• Select passwords based on common use or a particular user's additional details.
• Select passwords based on the target's password complexity policies.

[Brute force password] Given the finite space of possible passwords dictated by information determined in the previous steps, try each password for all known user accounts until the target grants access.

• Manually or automatically enter the first password for each known user account through the target's interface. In most systems, start with the shortest and simplest possible passwords, because most users tend to select such passwords if allowed to do so.
• Iterate through the remaining passwords for each known user account.

Prasyarat

The system/application uses one factor password based authentication.
The system/application does not have a sound password policy that is being enforced.
The system/application does not implement an effective password throttling mechanism.
The adversary possesses a list of known user accounts on the target system/application.

Keahlian yang Diperlukan

A Password Spraying attack is very straightforward. A variety of password cracking tools are widely available.

Sumber Daya yang Diperlukan

A machine with sufficient resources for the job (e.g. CPU, RAM, HD).
Applicable password lists.
A password cracking tool or a custom script that leverages the password list to launch the attack.

Mitigasi

Create a strong password policy and ensure that your system enforces this policy.
Implement an intelligent password throttling mechanism. Care must be taken to assure that these mechanisms do not excessively enable account lockout attacks such as CAPEC-2.
Leverage multi-factor authentication for all authentication services and prior to granting an entity access to the domain network.

Kelemahan Terkait

Referensi

REF-565

ACSC Releases Advisory on Password Spraying Attacks
https://www.us-cert.gov/ncas/current-activity/2019/08/08/acsc-releases-advisory-password-spraying-attacks

REF-566

A notorious Iranian hacking crew is targeting industrial control systems
Andy Greenberg.
https://arstechnica.com/information-technology/2019/11/a-notorious-iranian-hacking-crew-is-targeting-industrial-control-systems/

REF-567

Alert (TA18-086A): Brute Force Attacks Conducted by Cyber Actors
https://www.us-cert.gov/ncas/alerts/TA18-086A

Pengajuan

Modifikasi