Chief Editor What is a bruce force attack?
A brute-force attack guesses the password; here, the attacker runs software to try millions of passwords, usernames, and keys until one works.
Attackers use this method because it is cheap.
The strength of your password determines how many guesses it takes to crack it and how long it will take.
Say, for example, our password generator creates passwords in all combinations. So, if we keep the password length at 8 characters with special characters, symbols, and a mix of uppercase and lowercase letters, it will say, “A rig guessing a trillion passwords a second needs 36 minutes on average.” For a length of 9 s, characters, it will take 2.2 days; for 10 characters, 202 days; for 11, 50 years; for 12, 4.5 thousand years; and for 18 characters, it will take longer than the universe has existed, many times over on average.
You can clearly see how the addition of every character makes a change in the time to crack.
You can choose your own password, which you can remember easily; this is not an issue. But where you will use that password matters.
Attackers don’t start from zero; they have already decided what type of password you have been using before based on stolen credentials or leaked data.
According to a report, 51% of people use the same passwords everywhere.
That is why this type of attack works.
We will see the types of brute force attack and how they work.
Types of brute force attack:
There are different types of brute force attacks; we will see all of them.
Simple brute force: In this, the attacker will try every possible combination in order. They try every letter, every character. This is the slowest yet most successful form of attack. This practically works on short passwords.
Dictionary attack: In this, instead of using every combination, the attacker will use real-world names, say, for example, a city’s name, their personal name, a sports name, etc. The list is small compared to other types of attacks, but it is also the most effective attack.
Hybrid attack: A hybrid attack is something that’s covered with the dictionary attack. For example, orange will be guessed as Orange123! The machines are so advanced that adding a capital letter at the beginning and adding a special character and number at the end makes the hybrid attack easy to guess.
Credential stuffing: An attacker will take a username and password from an old attack or breach, then try it on other websites. As we already mentioned in our previous posts, people always try to reuse passwords. It can be the same or a hybrid, as mentioned.
Password Spraying: This is a different approach, where the attacker tries and attacks with 1 password on 1000s of accounts. Say, for example, “Orange!123”. This will avoid account lockout or other suspicious activity.
Reverse brute force attack: In this, the attacker will use a password that is common and will look for any username for which the password will work. The attacker will not care which account they get access to. They need access to any account.
Rainbow table attack: Websites that store your password do not store the password directly as you enter it. They scramble the password and store it in a hash format. A good password manager will add a random value to each password to make it harder. A rainbow table is a precomputed lookup file that finds common hashes to the original passwords.
Signs that you are under a brute force attack:
For a regular user of the internet:
- Login notifications to your email and 2FA OTP that are received without you trying to log in.
- Your account is locked, and you cannot log in.
- A password reset request that you never requested.
Signs that they got in:
- Messages or emails that you didn’t write.
- Password reset emails that have been deleted from the inbox.
- Purchases, invoices, subscriptions that you didn’t signup for.
For an enterprise running a website or server:
- Check for failed login attempts; usually this will be a small number. But if there is a spike in the number, a brute force has been attempted.
- Logins from a different country than where your users or employees work from.
- An increase in page views.
- High volume of connection attempts from the same IP.
Signs that they got in:
- Logins from a new device or IP.
- Active sessions of users at unusual times.
- Password change or multi-factor authentication code that you didn’t request.
How to prevent a brute force attack?
For a regular user of the internet:
Create a password that is longer and hard to crack. You can use our password generator and create a password with complexity.
Do not reuse a password. On average, a person can have 50-100 accounts on various websites, which include email, social media accounts, e-commerce accounts, etc. A common Person will have almost the same password for every account. They will forget which websites they have an account. If any of the websites get breached, then it is most likely the other accounts can also be compromised.
And so we strongly recommend that a new password be used for every account. Even in the event of a data breach, the damage stops at 1 account instead of 100 accounts.
Use multi-factor authentication or two-factor authentication wherever possible. With this, you will be notified that someone is trying to log in to your account, and you can change the password immediately.
Check if your password has been leaked for free on the Have I Been Pwned website and change the password wherever you use it.
If you run a website or server:
Limit your login attempts: Like said, limit your login attempts to 3-5 attempts and set an alert in case a wrong password is entered. When limited, the attacker cannot try over 5 passwords at the same time; also, you will be notified so you can change and block the login.
On VPN and other admin accounts, use multi-factor authentication, so if any document needs to be accessed, it should be approved by multiple people to access the folder.
Enable CAPTCHA, a simple technique that prevents bots from attempting multiple login attempts at once.
Watch and store your logs; make a framework to alert people in case of excessive login attempts or there is an unusual pattern in logs.
Final thoughts:
Brute force is a very old technique, but it is very effective.
By following the prevention techniques, we can protect ourselves from this type of attack.
Protect your passwords by using a reputable password manager application and using a strong password; this can protect you from this type of attack.
Remember, a brute-force attack is always an attack on your password.
Change your password often, create a strong and long password using a password generator, and check for data breaches on the dark web or on Have I Been Pwned-type websites to keep yourself safe.
Fredric Sherman 
Chief Editor