Are brute-force attacks against online accounts (gmail, facebook, instagram) something that really happens? I don't mean something like cracking password hashes or DDoS, but real brute-force attacks (e.g., password guessing) using a botnet or proxies.

I think most big web applications are secured against this using things like rate limits so it does not seem realistic to me but I would like to know if there are any known publications / statistics.

  • Attacks on something that is vulnerable to session-fixation are more common, 'cause it then does not have rate limiting. But then again, neither google, facebook or instagram are vulnerable to session-fixation. PS: I too did think you were talking about DDoS at first, 'till I've read the question a second time. – grochmal Sep 30 '16 at 16:15
  • @Martin sorry, my bad. but don't your ID get locked usually or you're prompted for Captcha or a two factor Authentication if your IP address is different? - all these require resources to implement, so the attacker is always looking for the absence of these – JOW Sep 30 '16 at 16:20
up vote 19 down vote accepted

I prefer to call them "online password guessing attacks" since "brute force" has a specific meaning that may not always apply to these attacks. But yes, they do still happen and here are a few example stats for you:

Microsoft: “we detect more than 10 million credential attacks every day across our identity systems.”

Akamai: They observed “999,980 IPs were involved in the attacks against [a financial institution] customer's login page.” 427 million accounts were checked in a one week period. Also saw 817,390 IPs making 388 million login attempts using 65 million email addresses against an entertainment industry customer. Comparing source IPs of both attacks, they found 70% match, implying the same org was responsible for both attacks, or that they used the same botnet.

Google: “We’ve seen a single attacker using stolen passwords to attempt to break into a million different Google accounts every single day, for weeks at a time. A different gang attempted sign-ins at a rate of more than 100 accounts per second.” This was reported in 2013, but I'm sure they still face similar attacks.

Taobao: Taobao was attacked via an online guessing attack over a few days in Oct 2015. The attackers used 99M credentials collected from other sites. 20.5 million credentials matched Taobao accounts, which was about 1 in 20 of their total annual active buyers. Wasn’t detected until November, however Alibaba says at the time their security systems discovered and blocked the vast majority of log-in attempts. Still resulted in around $1 million of fraud transactions on their site.

In these cases these sites may have rate limiting or other adaptive authentication controls in place, but they aren't 100% effective in preventing all account takeover attempts.

  • 3
    To piggy back. I have a dozen or so very small sights that no one visits. I get several thousand random login attempts a day. I use a combination of flood control black lists and captcha to protect my login and contact forms. Not only to these attacks still happen they are more numerous every year. – danielson317 Sep 30 '16 at 18:39
  • 20.5M out of 99M is about 1 in 5, or 20%, not 1 in 20. – jpmc26 Sep 30 '16 at 19:36
  • 1
    @jpmc26 Your math is impeccable, but Taobao qualified that figure by referring only to "annual active buyers" and not affected users as a whole. Presumably the other 15% is compromised customers who they don't consider 'active buyers'. Maybe this was their way of trying to downplay the impact. – PwdRsch Sep 30 '16 at 19:45
  • Or I should pay more attention to my units. Credentials != customers. lol. Sorry. Thanks. – jpmc26 Sep 30 '16 at 19:47
  • 3
    It sounds like some of these may not be "guessing" so much as using known credentials, either directly known to be the actual password, or a password used in combination with that email from another service. – Alexander O'Mara Sep 30 '16 at 21:08

Anecdotally, yes. WordPress sites are subject to straight-up password guessing attacks all the time. WordPress does allow user-name-enumeration by default, and there seem to be a few folks that use real user names to try to guess just the password, but the bulk of the attacks guess both user names and passwords.

I ran a WordPress honey pot for a couple of years, and I saw many password guessing attacks. Most were from a single IP address, but a few were from 50-60 IP addresses. I got as many as 280 thousand guesses in a day.

I don't know of any publications or even attempts at comprehensive stats, so all I've got are anecdotes.

  • It would be nice if you could release stats or even dumps from your honeypot, not only those related to password guessing attacks. – A. Darwin Sep 30 '16 at 16:24
  • @A.Darwin - see stratigery.com/phparasites for a write up of the first few months. Longer term, I re-wrote the honeypot, but the results were almost exactly the same. – Bruce Ediger Sep 30 '16 at 18:42

Captchas barge in the house to save the day. Not only captchas actually. Once I was trying to make a simple Gmail PDA (Python Dictionary Attacker). It just basically reads every line from a dictionary file and try all the words for the inputted email.

But I couldn't do it because Gmail has this new feature, a user setting, that disallows receiving or even authenticating from a "non-modern email service". And it's turned on by default. See this for more: https://support.google.com/accounts/answer/6010255?hl=en

But that doesn't mean it's not possible. It is. Of course they may not be "the thing" but they definitely are "a thing". There are a lot of young aspiring IT enthusiasts out there that are yet to reveal their talents. One of them might be the one to figure out a clever and more accurate way-around for these captchas. One of them could even be the one to hack the unhackable. And most of them have the goal of a white hat, or at least grey, and they just want you to feel a lot more secure so cheer up.

  • 2
    That feature disallows logins using clients not supporting OAuth2. Your bruteforcer failed because it was using plain IMAP, but nothing prevents you from making a bruteforcer which understands the OAuth flow and bruteforces the authorization page. – André Borie Sep 30 '16 at 18:32

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.