2

I do know the difference between brute force attack and DOS.

What if a web server doesn't have account lock out in place and a few brute force attacks is being started in parallel, and these attacks will keep web server CPU intensively busy. Will these attacks in the end reduce the abilities of web server to serve other legitimate requests and result in a DOS attack?

2

YES INDEED

I used to own a shared hosting business and, while being at a party on a weekend night, I received an automated monitoring notification triggered by a resource exhaustion. I immediately left to the office and when I arrived I found out a bruteforce attack against a client's WordPress admin panel was the cause of it.

Always make sure your firewall rulesets are up to date and that a service can't take others' resources in case of an anomalous event (containerization is your friend here).

0

The focus of a brute force attack is to get credentials in some way, is true that in some cases can create a DoS as a collateral effect, but I don't think this is the point. The nature of a DDoS is to saturate the resources and you dont care if you get the credentials or not basically. However there are some botnets that are designed to make brute force attacks and as a consequence of this DoS the services. For this types of attack you should apply rate limiting techniques on the backends, this will help to alleviate your systems and then have more time for reaction for putting other countermeasures.

0

Keep in mind that a bad actor may run multiple brute force attacks at the same time (for example by using two different wordlists in two different, parallel attacks) so this kind of attack may deplete your server's recourses.

Always have an "x-time attempt lockout" and remember not to reveal whether the email/username inserted is correct or not upon login failures.

0

Yes. If the server cannot keep up with repeated failed login attempts, it will result in a loss of service... aka a DoS if the requests are from ones source, a DDoS if the attack comes from multiple sources.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.