There are different types of attacks that are attempted on passwords such as:
Offline dictionary attack:
Typically, strong access controls are used to protect the system’s password file. However, experience shows that determined hackers can frequently bypass such controls and gain access to the file. The attacker obtains the system password file and compares the password hashes against hashes of commonly used passwords. If a match is found, the attacker can gain access by that ID/password combination. Countermeasures include controls to prevent unauthorized access to the password file, intrusion detection measures to identify a compromise, and rapid reissuance of passwords should the password file be compromised.
• Specific account attack: The attacker targets a specific account and submits
password guesses until the correct password is discovered. The standard countermeasure
is an account lockout mechanism, which locks out access to the account after a number of failed login attempts. Typical practice is no more
than five access attempts.
• Popular password attack: A variation of the preceding attack is to use a popular
password and try it against a wide range of user IDs. A user’s tendency
is to choose a password that is easily remembered; this unfortunately makes
the password easy to guess. Countermeasures include policies to inhibit the
selection by users of common passwords and scanning the IP addresses of
authentication requests and client cookies for submission patterns.
• Password guessing against single user: The attacker attempts to gain knowledge
about the account holder and system password policies and uses that knowledge to guess the password. Countermeasures include training in and enforcement of password policies that make passwords difficult to guess. Such policies address the secrecy, minimum length of the password, character set, prohibition against using well-known user identifiers, and length of time before the password must be changed.
• Workstation hijacking: The attacker waits until a logged-in workstation is
unattended. The standard countermeasure is automatically logging the workstation
out after a period of inactivity. Intrusion detection schemes can be
used to detect changes in user behavior.
• Exploiting user mistakes: If the system assigns a password, then the user is
more likely to write it down because it is difficult to remember. This situation
creates the potential for an adversary to read the written password. A user
may intentionally share a password, to enable a colleague to share files, for
example. Also, attackers are frequently successful in obtaining passwords by
using social engineering tactics that trick the user or an account manager into
revealing a password. Many computer systems are shipped with preconfigured
passwords for system administrators. Unless these preconfigured passwords
are changed, they are easily guessed. Countermeasures include user training,
intrusion detection, and simpler passwords combined with another authentication
• Exploiting multiple password use: Attacks can also become much more effective
or damaging if different network devices share the same or a similar password for a given user. Countermeasures include a policy that forbids the same or similar password on particular network devices.
• Electronic monitoring: If a password is communicated across a network to log on to a remote system, it is vulnerable to eavesdropping. Simple encryption will not fix this problem, because the encrypted password is, in effect, the password and can be observed and reused by an adversary.
Resource : Computer Security Principles and Practice William Stallings