Brute force attacks detection risks

Question

I would like to ask if using brute force attacks on some websites or online services can be risky in any way for the hacker? Let's say that someone is using medusa tool to crack password on his account at some server. Is this visiable for administrators and risky somehow for the potential attacker? Or is it just seen as a milions tries to log in to the particular server and not as a threat? Can simple antivirus with firewall like lets say Avira detect this kind of penetration attempts? Do you actually think that anyone is looking at the login attempt logs or are they just ignored by the administrators or do they even exist on a regular server? I know that I sound like a beginner because thats who I am, but i cannot find much information about it on the internet.

Answer 1

You didn't mention specifically whether you're referring to an online or offline brute force attack, but seeing as you mentioned medusa I'll assume online.

You also haven't said what protocol you're trying to brute force over or what application you're trying to log into. Eg. web app over HTTP, RDP, FTP?

Is this visiable for administrators

Definitely. It's not certain that they log it but most HTTP servers store access logs and most login systems also record failed login attempts in some way.

Or is it just seen as a milions tries to log in to the particular server and not as a threat?

No one would legitimately make millions of log-in attempts. If anyone did happen to look at the logs and notice it they'd certainly assume it was a threat.

Can simple antivirus with firewall like lets say Avira detect this kind of penetration attempts?

Can't speak specifically for Avira but there's a chance your attack may also be seen as a DoS if the volume is high enough. Also, it's common for online applications to run an IDS (intrusion detection system) or a WAF (web application firewall) which would be more likely to detect things like this.

Do you actually think that anyone is looking at the login attempt logs or are they just ignored by the administrators or do they even exist on a regular server?

As an example, HTTP access, SSH login attempts, etc. will be logged on just about every server. Whether anyone looks at them depends highly on who's running it. You can assume that most large scale systems will have considerable log monitoring in place.

There's also software that watches log files for failed password attempts and bans them automatically, such as fail2ban.

I think you've also discounted application level controls against brute forcing - any well designed login system will lock you out after a certain number of password failures.

Even in the case of an offline attack there's ways of detecting it, such as a honey pot account or honey words that will hopefully lead the attacker to log into an isolated account and alert you before they can log into a real account.