CAPEC-16: Dictionary-based Password Attack
Description
An attacker tries each of the words in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user was a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern. Dictionary Attacks differ from similar attacks such as Password Spraying (CAPEC-565) and Credential Stuffing (CAPEC-600), since they leverage unknown username/password combinations and don't care about inducing account lockouts.
- Likelihood of attack
- Medium
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Employ Probabilistic Techniques
Prerequisites
- The system uses one factor password based authentication.
- The system does not have a sound password policy that is being enforced.
- The system does not implement an effective password throttling mechanism.
Skills required
- LowA variety of password cracking tools and dictionaries are available to launch this type of an attack.
Consequences
- ConfidentialityAccess ControlAuthentication
Gain Privileges
- Confidentiality
Read Data
- Integrity
Modify Data
Mitigations
- Create a strong password policy and ensure that your system enforces this policy.
- Implement an intelligent password throttling mechanism. Care must be taken to assure that these mechanisms do not excessively enable account lockout attacks such as CAPEC-2.
- Leverage multi-factor authentication for all authentication services.
Related weaknesses (CWE)
- CWE-262Not Using Password Aging
- CWE-263Password Aging with Long Expiration
- CWE-307Improper Restriction of Excessive Authentication Attempts
- CWE-308Use of Single-factor Authentication
- CWE-309Use of Password System for Primary Authentication
- CWE-521Weak Password Requirements
- CWE-654Reliance on a Single Factor in a Security Decision