I've been doing some research on hacking recently and I found some very interesting tutorials on brute force cracking. I have some questions to ask and I'll be using Facebook as an example.

Let's say that a man decides to crack the password of a single account. He downloads some Brute force program and sets it to try every single password combination with different IPs. The same IP would be used until the captcha comes up, then it will be replaced by a new one, so facebook would not be able to stop the attack by blocking the IP.

Maybe I'm just stupid (I'm not experienced in this stuff) but the only way I see that facebook can use to stop this attack is by locking the account itself (preventing anyone from logging in), but that's bad for business because it would prevent the owner itself from logging in. Does facebook actually do this for such attacks? I assume that a large website like facebook would receive these sort of attacks frequently from different crackers, and some of them may actually attack several accounts at the same time.

So what does facebook do to prevent this? Because I don't see anything it can do besides lock the account, which is not practical. It may take months or years but with this method the hacker will eventually be able to log in, would he not?

  • 2
    CAPTCHA will slow cracker down, no? Also, if username == target then pause() – Neil McGuigan Mar 18 '15 at 18:53
  • 6
    What about putting the CAPTCHA per account and not per IP ? If an account had too many login attempts, just present a captcha no matter what the user's IP is. – user42178 Mar 18 '15 at 21:56

Despite the fact that Facebook locks accounts after many tries as the other answers said, you should keep in mind that "replacing your IP with a new one" is not as trivial as you make it sound.

Most internet service provider allow you to release your IP lease and get a new IP address, but the attacker will usually receive one from a small pool of a few hundred to a few thousand IP addresses.

Sure, there are proxy servers and the TOR network, but these will only supply the attacker with a few hundred additional IPs.

When the attacker has access to a botnet, they could use each bot of the botnet to request as many IP as they can get from their respective ISPs (good luck doing this without the user noticing anything). But large botnets are expensive.

Spoofing the IP address won't work either, because IP spoofing isn't easy to do when you want to not just sent packets but also receive the responses. When you want to brute-force a HTTP login, you will need to perform a TCP handshake first, which requires to be able to receive responses. Also you certainly want to parse the response to know if you were successful.

And even when you could theoretically use all ~4 Billion IPv4 addresses the internet has to offer, multiplying your tries with 4 billion only gives you enough tries to bruteforce passwords with 4-6 additional characters (depending on how many different characters the password contains).

And last but not least, the main problem with brute-forcing via network is the bandwidth you have available which greatly limits your attempts per seconds compared with what you can do when you brute-force hashes locally.

When you use a 8 character password with mixed case, numbers and special characters and no dictionary relation (common recommendation), brute-forcing via network is completely infeasible, even when the system uses no flood protection whatsoever.

  • I'm not sure exactly what you mean by botnets are expensive (time and or money?) But I have seen a few brute force attacks on websites I manage with over 20,000+ IPs being used with a very unsophisticated attack in a short amount of time. This leads me to believe that it is not difficult to gather so many IPs. I agree that brute forcing a strong password (xkcd style imo is best) is infeasible, but brute forcing a popular/weak password with 20,000 tries should be easy if there are no added security measures in place. – KnightHawk Mar 19 '15 at 4:26

I know that facebook has a few different security settings and that not everyone uses them to the fullest extent, so I will just go with the settings that I know from personal experience. Your mileage may vary.

Facebook has a built in method of determining a users chosen devices that are allowed to access the account. If someone from a new device attempts to log into my account I will receive a message (email or text) that a new device has attempted (or successfully) accessed my account. This in itself does not actually "stop" brute force attacks, but combined with two step authentication it can.


Facebook does temporarily lock accounts. After too many authentication failures, it temporarily locks the facebook account for a few hours, and requires a security question/verification code to unlock the account for more verification attempts. After a 24 timeout period, you can log in again. To the consumer, 24 hours without Facebook is not the end of the world. To the brute forcer, a 24 hr delay every X attempts is a major pain. It's a good compromise between usability and protection.

Of course, even in this scenario an attacker could get into an account with a sufficient amount of time. But now the sufficient amount of time is measured in months and years.

  • But that's insane because someone could attack an account on purpose not to crack it but as revenge against the user to block him. – George Mar 18 '15 at 14:28
  • It looks like Facebook then requires a security question/friend's verification code to unlock the account for more verification attempts. At that point, I think Facebook's support team would get involved and start banning IP addresses. – Ohnana Mar 18 '15 at 14:34
  • Another common technique is to slow the response to login attempts. ie; Delay sending any response by n seconds if there have been n consecutive failed logins. And of course, when you lock or slow an account, don't give away the game by announcing it. A locked account should continue to accept login attempts, but make sure they always fail, even with the correct password. – ddyer Mar 22 '18 at 2:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.