CAPEC-49: Password Brute Forcing
Description
An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password.
- Likelihood of attack
- Medium
- Typical severity
- High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Employ Probabilistic Techniques
Prerequisites
- An adversary needs to know a username to target.
- The system uses password based authentication as the one factor authentication mechanism.
- An application does not have a password throttling mechanism in place. A good password throttling mechanism will make it almost impossible computationally to brute force a password as it may either lock out the user after a certain number of incorrect attempts or introduce time out periods. Both of these would make a brute force attack impractical.
Skills required
- LowA brute force attack is very straightforward. A variety of password cracking tools are widely available.
Consequences
- ConfidentialityAccess ControlAuthorization
Gain Privileges
- Confidentiality
Read Data
- Integrity
Modify Data
Mitigations
- Implement a password throttling mechanism. This mechanism should take into account both the IP address and the log in name of the user.
- Put together a strong password policy and make sure that all user created passwords comply with it. Alternatively automatically generate strong passwords for users.
- Passwords need to be recycled to prevent aging, that is every once in a while a new password must be chosen.
Related weaknesses (CWE)
- CWE-257Storing Passwords in a Recoverable Format
- CWE-262Not Using Password Aging
- CWE-263Password Aging with Long Expiration
- CWE-307Improper Restriction of Excessive Authentication Attempts
- CWE-308Use of Single-factor Authentication
- CWE-309Use of Password System for Primary Authentication
- CWE-521Weak Password Requirements
- CWE-654Reliance on a Single Factor in a Security Decision
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-OTPOne-time Password1 shared
- D3-PWAPassword Authentication1 shared
- D3-PRPassword Rotation1 shared
- D3-SPPStrong Password Policy1 shared
- D3-ANAAAdministrative Network Activity Analysis1 shared
- D3-CDPChange Default Password1 shared
- D3-AEMApplication Exception Monitoring1 shared
- D3-OPMOperational Process Monitoring1 shared
- D3-ANCIAuthentication Cache Invalidation1 shared
- D3-CCSACredential Compromise Scope Analysis1 shared
- D3-CHCredential Hardening1 shared
- D3-CRCredential Revocation1 shared