A lot of questions here are about the safety of passwords e.g a Login Password to an account on site X. But how can attackers get in the account when they have to guess the passwords? I know there is the "brute-force" method but most sites will simply lock the account, when there are too many false tries. So how get hackers access to the account?

  • 1
    First of all, nobody tries to brute-force passwords online, because it would be terribly slow. Secondly, locking an account after X false tries is a vulnerability itself, as an attacker just needs an automatic script that attempts to log in as me and it would keep my account perpetually locked. – MechMK1 Aug 27 '19 at 11:49
  • 4
    "most sites will simply lock the account" - citation needed – schroeder Aug 27 '19 at 11:50
  • 2
    @MechMK1 That's not entirely true. Password "spraying" is becoming more common and is a form of brute force. – Conor Mancone Aug 27 '19 at 12:02
  • @ConorMancone Yes, that's true. I really didn't think of that. – MechMK1 Aug 27 '19 at 12:04
  • 1
    Most site will throttle you... they can just delay the responses by some seconds. This is just a minor annoyance to the real user, but slows an attacker by a couple of order of magnitudes. – Giacomo Alzetta Aug 27 '19 at 12:36

Brute Force Options:

Credential Spraying (distributed brute force): try the same password on multiple accounts or multiple systems (or variations on this theme). No one account is getting focus, so the attack on each account goes under the radar.

Offline Brute Force: use a weakness in the system to extract the password database that contains the (hopefully) hashed passwords. Take all the time you want to crack each hash (or the hash of the account you want).

Online Brute Force: public sites don't lock the account when there are too many tries. They might block the IP of the source of the failures, but then the attacker can change IPs. It's possible to slow attacks down to stay under the settings of the automated protection mechanisms.

Password reuse: look up a database of breached credentials and try that combination on popular services. It's effectively one try per service. For accounts that show up multiple times, use the collection of passwords used.

Process Weaknesses:

Authentication weaknesses: flaws in the system might allow the attacker to gain access to other accounts or parts of the information that should only be accessible to the authorised account. This is pretty rare and a highly specific problem.

Social Engineering:

Phishing: just ask the person for their credentials

Help Desk Hacking: use weak password reset processes or the online support desk to get the service to grant the attacker access to the account

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.