How can Facebook possibly stop a bruteforce attack on an account?

Question

I've been doing some research on hacking recently and I found some very interesting tutorials on brute force cracking. I have some questions to ask and I'll be using Facebook as an example.

Let's say that a man decides to crack the password of a single account. He downloads some Brute force program and sets it to try every single password combination with different IPs. The same IP would be used until the captcha comes up, then it will be replaced by a new one, so facebook would not be able to stop the attack by blocking the IP.

Maybe I'm just stupid (I'm not experienced in this stuff) but the only way I see that facebook can use to stop this attack is by locking the account itself (preventing anyone from logging in), but that's bad for business because it would prevent the owner itself from logging in. Does facebook actually do this for such attacks? I assume that a large website like facebook would receive these sort of attacks frequently from different crackers, and some of them may actually attack several accounts at the same time.

So what does facebook do to prevent this? Because I don't see anything it can do besides lock the account, which is not practical. It may take months or years but with this method the hacker will eventually be able to log in, would he not?

Answer 1

Despite the fact that Facebook locks accounts after many tries as the other answers said, you should keep in mind that "replacing your IP with a new one" is not as trivial as you make it sound.

Most internet service provider allow you to release your IP lease and get a new IP address, but the attacker will usually receive one from a small pool of a few hundred to a few thousand IP addresses.

Sure, there are proxy servers and the TOR network, but these will only supply the attacker with a few hundred additional IPs.

When the attacker has access to a botnet, they could use each bot of the botnet to request as many IP as they can get from their respective ISPs (good luck doing this without the user noticing anything). But large botnets are expensive.

Spoofing the IP address won't work either, because IP spoofing isn't easy to do when you want to not just sent packets but also receive the responses. When you want to brute-force a HTTP login, you will need to perform a TCP handshake first, which requires to be able to receive responses. Also you certainly want to parse the response to know if you were successful.

And even when you could theoretically use all ~4 Billion IPv4 addresses the internet has to offer, multiplying your tries with 4 billion only gives you enough tries to bruteforce passwords with 4-6 additional characters (depending on how many different characters the password contains).

And last but not least, the main problem with brute-forcing via network is the bandwidth you have available which greatly limits your attempts per seconds compared with what you can do when you brute-force hashes locally.

When you use a 8 character password with mixed case, numbers and special characters and no dictionary relation (common recommendation), brute-forcing via network is completely infeasible, even when the system uses no flood protection whatsoever.

Answer 2

I know that facebook has a few different security settings and that not everyone uses them to the fullest extent, so I will just go with the settings that I know from personal experience. Your mileage may vary.

Facebook has a built in method of determining a users chosen devices that are allowed to access the account. If someone from a new device attempts to log into my account I will receive a message (email or text) that a new device has attempted (or successfully) accessed my account. This in itself does not actually "stop" brute force attacks, but combined with two step authentication it can.

Answer 3

Facebook does temporarily lock accounts. After too many authentication failures, it temporarily locks the facebook account for a few hours, and requires a security question/verification code to unlock the account for more verification attempts. After a 24 timeout period, you can log in again. To the consumer, 24 hours without Facebook is not the end of the world. To the brute forcer, a 24 hr delay every X attempts is a major pain. It's a good compromise between usability and protection.

Of course, even in this scenario an attacker could get into an account with a sufficient amount of time. But now the sufficient amount of time is measured in months and years.