151

Well, let's start with math: If we assume that your password consists of lowers, uppers, and numbers, that's 62 characters to choose from (just to keep the math easy, real passwords use symbols too). A password of length 1 has 62 possibilities, a password of length 2 has 62^2 possibilities, ..., a password of length n has 62^n possibilities. So that means ...


149

What's the point of this kind of "attack"? The rate is much too slow to do any efficient brute-forcing, and I really doubt that someone would specifically target my tiny personal server. The rate is slow, or the total amount of data being sent out is small? You may be seeing connections very rarely, but how do you know the bots doing the brute forcing aren'...


137

You can't hide your IP address on the internet. They aren't secret. Pretty much what @DeerHunter said. It's trivial to scan the entire internet. If they want, they can target all-known digital ocean droplets that are online. They can do this on a timer so that when you go offline, or online, it will just keep trying as those may be high-value targets that ...


122

You are essentially asking if it is safe to pass secret parameters in a GET request. This is actually classified as a vulnerability. It is not feasible to brute force a sufficiently long pseudorandom string, assuming the server simply returns a static 404 response whenever an invalid path is specified, but there are numerous other security issues in practice ...


112

The answer always depends on your threat model. Security is always woven into a balance between security and usability. Your approach inconveniences the hackers trying to break into the account, but also inconveniences a user who merely mistypes their password. If the fake account is believable enough to fool an attacker, it may also be believable enough ...


100

Your most recent edit indicates that your pictures are procedurally-generated, so your key size will therefore be bounded by the amount of state required to generate an image. Yours seem to be parameterized by four floats for the initial conditions (and fixed output image size, camera location, point light location, convergence conditions, etc). Those 128-...


89

Unless you have separate means of restricting access to the login form itself, a good baseline is don't have a hard limit. That's because it's way too easy for someone to be completely locked out of their account. This is bad because of the denial of service, obviously, but it's also a security concern in itself. It will increase support requests from ...


70

Sure it's possible, but it doesn't really help. The number of possibilities is just too large. Consider that a 256-bit key has 2256 possible values. That's 12✕1076, or 12 followed by 76 zeroes. If we generously assume that a computer can test a trillion (that's 1012) possible keys a second, and that we have a trillion computers (where will we get them from?)...


65

The protections you describe are good ones that you should consider, but there can still be weaknesses: Many CAPTCHAS can be solved by robots, or you can easily pay people to solve them en masse for you (there are companies selling that service). Account lock out is a good idea, but if you do it based on IP someone with access to a botnet could retry login ...


64

Yes it looks like you are experiencing a brute force attack. The attacker is in on a class B private address, so it is likely to be someone with access to your organization's network that is conducting the attack. From the usernames it looks like they are running though a dictionary of common usernames. Have a look at 'How to stop/prevent SSH bruteforce' (...


63

Any encryption is vulnerable to brute force attack, for example AES-256 has 2^256 keys, and given enough hardware we can “easily” brute force it. The problem is that there’s not enough silicon on Earth to construct enough processors to do it before the heat death of the universe. The fact that encryption can be bruteforced doesn’t mean that this will happen ...


61

About a day If we're lucky: there's no throttling, we can perform each test with a HEAD request, can perform many tests on a single HTTP connection with Keepalive, and can have many concurrent connections. In that case we're mostly limited by bandwidth. Say we craft a tight request that is 100 bytes, that means we need to send a total of 100 * 1010 bytes. ...


60

Apart from the maths detailed by @Mike, consider also that the password length leaks all over the place: When it is typed, a sneaky bystander can learn it, either by counting the '*' on the screen, or listening to the keystrokes (in the latter case, he can record the sound with his smartphone and play it as his leisure). In a classic "Web browser" scenario, ...


60

A simple answer, NO. It is like asking, if I know, that x%4 = 3, is it possible to find the value of x? No. Surely, there would be infinite values of x satisfying this equation, but you wouldn't simply know which one is correct. Similarly, many(or infinite) video clips could result in a given hash value(obviously, infinite video clips have to be mapped to ...


59

The IPv4 address space is limited to only 4,294,967,296 addresses.[note 1] Given enough bandwidth, it becomes trivial to scan every single IP address out there, especially if you're the owner of a botnet consisting of thousands of hacked devices. With IPv6[note 2], things are a bit more tricky: with over 300,000,000,000,000,000,000,000,000,000,000,000,000 ...


58

How are plaintext and hashes compared? During the brute force attack, words from the dictionary are hashed with the correct hash algorithm and salt, and then compared to the hash in the database dump. So the attacker needs to know not only the hash value itself, but the algorithm and the salt. How does the attacker know the salt? The salt is generally ...


57

One related question that you missed in your list is this one: How critical is it to keep your password length secret? The accepted answer there (disclaimer: mine) shows that if you have a password scheme which allows all 95 printable ascii characters, then the key space ramps insanely quickly every time you increase the length of the password by 1. You ...


56

It is very common. Many botnets try to spread that way, so this is a wide scale mindless attack. Mitigation measures include: Use passwords with high entropy which are very unlikely to be brute-forced. Disable SSH login for root. Use an "unlikely" user name, which botnets will not use. Disable password-based authentication altogether. Run the SSH server on ...


55

I'm choosing to assume you're asking why it's a risk rather than how to hack. GPUs are very good at parallelising mathematical operations, which is the basis of both computer graphics and cryptography. Typically, the GPU is programmed using either CUDA or OpenCL. The reason they're good for brute-force attacks is that they're orders of magnitude faster than ...


54

Yes, this is a perfectly reasonable and common approach. However, you've reinvented fail2ban. You probably want to switch to using that instead so you don't have to debug issues with your script and can make use of the existing filters for ssh, apache, and other common services. Unfortunately, there is not terribly much you can do with these IPs. You can ...


52

You really can't, if you're just encrypting / decrypting text. If you know that the encrypted string is "kdo" and the encryption method is a Caesar shift, the plaintext could just as easily be "IBM" as "HAL". You'd have to have some idea of what the plaintext "looks like". For instance, if you know the plaintext is the name of a Stanley Kubrick character, ...


51

In some cases yes, you can guess the most frequently used keys by the wear marks. That's how I know that apparently I use the L, M, N, A and E keys a lot - the keys are now just black, the letter is faded. And one special key being significantly more used than the others - unless it's "{", "}" or ";" and you happen to be a programmer - could allow to ...


51

The private key is unrelated to the passphrase. So is the public key. The public key is also generally stored unencrypted, even when the private key is protected by a passphrase. (Exceptions may exist where the public key is stored in an encrypted form, but in the basic case and assuming a sufficiently large key, doing so provides no additional security ...


50

Yes, failed login attempts should be logged: You want to know when people are trying to get in You want to understand why your accounts are getting locked out It's also very important - older Windows logging process never emphasized this enough - to log successful login attempts as well. Because if you have a string of failed login attempts, you really ...


47

Fooling an attacker with false positives isn't a bad idea, and it's not new. The following may interest you. Cryptographic Camouflage CA technologies has patented a technology known as Cryptographic Camouflage. A sensitive point in public key cryptography is how to protect the private key. We outline a method of protecting private keys using ...


47

Attackers often don't just use dictionaries, but also rules which permute the words in dictionaries. For instance, a rule could be to substitute certain letters for numbers, which look the same. This would turn Password into P455w0rd. A rule, which could apply in this case, would be to remove single letters from a word. That means just permutating the ...


44

An important one that hasn't been added to the list is the crackstation wordlist The list contains every wordlist, dictionary, and password database leak that I could find on the internet (and I spent a LOT of time looking). It also contains every word in the Wikipedia databases (pages-articles, retrieved 2010, all languages) as well as lots of ...


42

To complete @Terry's answer: a GPU has a lot of cores (hundreds). Each core is basically able to compute one 32-bit arithmetic operation per clock cycle -- as a pipeline. Indeed, GPU work well with extreme parallelism: when there are many identical work units to perform, actually many more than actual cores ("identical" meaning "same instructions", but not "...


42

Is this a bruteforce attack This looks like the background scanning that any server on the internet will experience. Should I be worried Not really, background scanning is completely normal, as long as your passwords are secure background scanning should pose no risk. What are the best mitigation steps You can use the following to make the server more ...


Only top voted, non community-wiki answers of a minimum length are eligible