71

Some websites lock out a user after a series of incorrect password attempts for example for 15 minutes. If a malicious actor knows this, can they deliberately try logging in with incorrect passwords every 15 minutes to prevent the real person from logging in? Is this a real threat and if so how can websites protect against it?

Improve this question
14
  • 7
    When I was in high school, the NT domain would lock you out for 15-20 minutes after 3-5 incorrect attempts, and usernames were based on people's real names. If you knew how to enter the keystrokes to log out (Ctrl-Alt-Del, L, Enter), you could lock someone's account on your own computer, walk up behind him, reach over, and log him out before he could react.
    – chrylis -cautiouslyoptimistic-
    Apr 6, 2017 at 7:40
  • 15
    Most online banking sites I've had the "pleasure" of using seem to be vulnerable to this. After 3 failed attempts the account gets permanently locked. You need to go to the bank and personally request that it gets reopened - they don't charge any fees for it, but it IS a hassle. Now, given that this is about finance, one might argue that this is OK. BUT, in nearly ALL the banks I've used bar one, the username is JUST a number. A malicious person could very easily lock accounts left and right for the "lolz".
    – MBender
    Apr 6, 2017 at 7:51
  • 13
    @Shaamaan A few years ago, I ran into this, but discovered that I'd actually mis-remembered my username, so I had locked someone else out unintentionally.
    – Joshua Taylor
    Apr 6, 2017 at 17:54
  • 3
    I've taken down production systems by accidentally trying to log into system accounts with incorrect passwords. Something to keep in mind if you're creating an account lockout policy for system accounts. :)
    – Tanner Swett
    Apr 7, 2017 at 2:25
  • 10
    @Shaamaan And a certain bank that shall remain unnamed had it even worse, the users were numbered sequentially , so anyone could lock out the whole bank with a bit of scripting.
    – Radovan Garabík
    Apr 7, 2017 at 7:22

6 Answers 6

Reset to default
57

Login brute-force protection can be enforced in three ways:

  • Temporary Lockout
  • Permanent Lockout
  • CAPTCHA

In my perspective, CAPTCHA is the most reasonable solution to avoid the risk of bruteforce as well as denial of service due to account lockout. You might have seen a CAPTCHA appearing on the login pages of Facebook and Gmail in case you enter wrong password more than three or four times. That's a decent way of restricting bots from bruteforcing and at the same time avoiding locking users out.

Permanent lockout is not a novel solution, and it adds a lot of operational overhead to customer support team if they have to manually unlock the account for the user. Temporary lockout on the other hand deter bruteforcing, but like the scenario you mentioned, it can lock out a genuine user.

Improve this answer
11
25

Yes, some websites do that in order to prevent bruteforce or password guessing attacks. Instead of banning the user, the website should ban the IP address from accessing the website.

If the attacker is hopping from one IP address to another and doing the brute force attack, then in that case the website can ban the user id and notify the banned user through email or some other way or may be banning the user for a short duration of time will also do the needful.

Improve this answer
12
  • 9
    There is a virtually infinite IP space available to any end user in IPv6.
    – curiousguy
    Apr 5, 2017 at 20:46
  • 12
    In IPv6 it would be safe enough to (temporarily) ban an offending /64 without much risk of affecting other users.
    – Foo Bar
    Apr 5, 2017 at 21:04
  • 2
    Usually, the computer can use 1.8E19 different IPv6 adresses without any effort.
    – curiousguy
    Apr 5, 2017 at 22:08
  • 7
    yes but as pointed out by @FooBar you don't ban the single IPv6 address but the /64 network.
    – JFL
    Apr 6, 2017 at 7:49
  • 3
    @KarlBielefeldt Lock out the whole corporation from trying to log into one guy's account? Heck yeah, that guy should be the only one on the network trying.
    – Delioth
    Apr 7, 2017 at 18:25
6

Yes and it has been done before. This can cause a big problem with certain websites. OWASP lists some examples of how it can go wrong on their page on Blocking Brute Force Attacks...

Account lockout is sometimes effective, but only in controlled environments or in cases where the risk is so great that even continuous DoS attacks are preferable to account compromise. In most cases, however, account lockout is insufficient for stopping brute-force attacks. Consider, for example, an auction site on which several bidders are fighting over the same item. If the auction Web site enforced account lockouts, one bidder could simply lock the others' accounts in the last minute of the auction, preventing them from submitting any winning bids. An attacker could use the same technique to block critical financial transactions or e-mail communications.

Improve this answer
5

Other answerers have already offered some valuable means by which a website can prevent abuse of anti-password-guessing measures to lock people out. Here is another one: IP whitelisting.

@Skynet already suggested blacklisting , but with attackers nowadays being able to build botnets well over a million devices in size, that might not be very effective against a resourceful attacker. (Note that an attacker wouldn't necessary have to build such a botnet themselves: many cybercrooks rent out access to their bots.)

So whilst blacklisting could offer a defense against a less powerful attacker, if an attack scales up to a large number of IP addresses, an alternative would be to try to restrict access to IP addresses which have previously been used to successfully log in to the account.

Of course, care still needs to be taken: if an attacker has access to a device that uses a whitelisted IP address, a website should look to ensure this will not allow the attacker to escape brute-force detection. Also, since a user may have a dynamic IP address or for some other reason try to login from a new IP, there needs to be some alternate mechanism by which the user can bypass the login blocking, such as:

  • By entering a CAPTCHA (though be warned: a determined attacker could hire people to solve these at a surprisingly low price);
  • Clicking a link in an e-mail (you'll also want to build in some checks to prevent this from being abused to flood people's inboxes); or
  • Using some kind of two-factor authentication to prove that they are the legitimate owner of the account.
Improve this answer
2

Yes, this is a real threat and is to be considered when you construct your brute-force defenses. These kinds of attacks have been conducted as well, so it's not purely theoretical.

Typically nowadays a system will provide a locked-out user with some means to reset his account, usually through a separate channel (mail, SMS, etc.)

Improve this answer
-2

Yes, it's possible. But it can be prevented using CAPTCHA, if the login form has it the only way to achieve this would be manually entering incorrect passwords and is a minor risk. The attacker must be really mad to spend his entire day locking your account

Also you should only indicate the account is locked when the user enters his credentials correctly to prevent account enumeration and never distinguish when the attacker enter the wrong password or if the user doesn't exist

Improve this answer
10
  • 10
    Huh, if you say it's locked only when you find the right credentials, then it seems very vulnerable: I can keep brute forcing a locked account to know the password, and once found, just wait until it get unlocked.
    – Xenos
    Apr 5, 2017 at 15:55
  • 4
    You don't even need to reveal that the account is locked - just send a single email to the account holder, and keep using the normal "Incorrect credentials" message for every attempt.
    – Matthew
    Apr 5, 2017 at 15:56
  • 8
    Mad attackers and backdoored toasters. It's a brave new world, people!
    – Awn
    Apr 5, 2017 at 15:59
  • 2
    @Xenos: The usual approach for only revealing lock on correct password is to reveal to correct user that the security protocol has been activated and they have to take action. Typically part of the unlocking procedure is to set a new password (effectively re-verify via email, same as a "forgot password" scenario) - this mitigates attacker gaining knowledge through the brute-forcing (if the locked message is shown on the page). In the meantime a far more likely scenario is that attacker gives up or wastes time on the attack by taking useless actions.
    – Neil Slater
    Apr 6, 2017 at 11:53
  • 2
    @NeilSlater To me, it seems you don't get that server cannot tell whether the logged in user is the legitimate one (the one to tell "account locked down") or the attacker who manage to guess the password. A locked account is an account you can no longer log in no matter whether you have the right password. I'll end it there (to avoid messing comments). Ask people on tchat to explain you.
    – Xenos
    Apr 7, 2017 at 8:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .