A Complete Guide to Brute Force Attacks: Part 1

Learn what a brute force attack is and how to protect your businessWhen it comes to brute force attacks, a business network can easily become compromised if the right cybersecurity measures are not in place. ORAM Cybersecurity Advisors looks at what a brute force attack is, different types of brute force attacks, and how businesses can protect themselves from becoming a victim.What is a Brute Force Attack?A brute force attack is a method of hacking popular with cybercriminals. The term “brute force” originates from attackers using excessive forceful attempts to gain unauthorized account access. Brute force attacks use trial and error to mine passwords, usernames, and encryption keys that would otherwise protect networks, email, files, and data.Though this is an older method of executing a cyberattack, it continues to work well for cybercriminals. With the right software, it also takes little effort on their part to make short work of getting into personal accounts, systems, and networks.While brute force attacks are a reliable, easy method used by hackers to gain access to both individual accounts and company networks, they can take months or even years to successfully execute. With patience, the attackers know they can gain huge rewards for their efforts.Many bad actors have software that attempts multiple combinations of usernames and passwords to access accounts and systems until unauthorized access is gained. Additionally, there are different types of brute force attacks that bad actors can use. These include:

1. Simple Brute Force Attacks
2. Dictionary Attacks
3. Hybrid Brute Force Attacks
4. Credential Stuffing
5. Reverse Brute Force Attacks

(Note: See Part 2 of this blog for more information about the different types of brute force attacks.)Motivation Behind Brute Force AttacksCybercriminals can make money from brute force attacks in several ways. For starters, they may hack a website where they can push spam ads to earn a profit with every click by visitors to the site. They can also reroute traffic to legitimate or even illegal ad sites to make a profit.By infecting a website and visitors to a company site, hackers can collect data using malware or spyware. They can then sell the data they collect to advertisers or on the Dark Web without the user’s permission.Furthermore, attackers can steal personal data ranging from confidential medical information to bank account details. This allows the bad actor to spoof a person’s identity, open new credit accounts, steal money, sell their credentials for a profit, or even launch ransomware attacks. Corporate attacks mean bad actors stealing an organization’s sensitive and proprietary data to sell for profit, often to other competitors or even other nations.Spreading malware through email, short message service (SMS) messages, or spoofed websites is yet another motive. They may simply want to demonstrate their ability to perform a cyberattack by infecting a user’s computer or a business network to launch a broader attack at a later date for a profit.Preventing Brute Force AttacksThere are several methods for protecting your business from brute force attacks. Employing strong password etiquette is the best place to start. Train your employees quarterly on password etiquette and cybersecurity best practices.Employing high encryption rates and virtual private networks (VPNs) can also help prevent brute-force attacks. Salting passwords is another way to make cracking passwords that much more difficult. Adding multifactor authentication (MFA) adds another layer of security to your networks and systems.Another way to prevent brute-force attacks is to limit login attempts. Employing internet protocol (IP) blacklists of known threat actors and a CAPTCHA box during the login process can also bolster your cybersecurity against brute force attacks. Be sure to also shut down unused accounts on the company network. Having the right software in place can also make a world of difference in preventing brute force attacks against your business.Password EtiquetteStart with making passwords and password phrases as difficult to crack as possible. Educate your staff about password best practices. Not only will it be more time-consuming for hackers, but it will make it more difficult for them to figure out passwords as well.Create strong passwords using both uppercase and lowercase letters, numerals, and special symbols that are more than 10 characters in length. Passphrases use a string of multiple words to create more elaborate login credentials that are more complicated when it comes to hacking. Longer, more complex passwords and passphrases are more troublesome for cybercriminals without the use of a sophisticated supercomputer.Another way to complicate your passwords and passphrases is to shorten standard words. Rather than typing “blue” remove the verbs to have just “bl” or change “hope” to “hp.” Be sure to avoid common passwords such as names, sports teams, pet names, or the word “password.” Hackers know what common words to look for and know how to wield them to their advantage so just avoid them altogether.Additionally, be sure to use a unique password or passphrase for every account, service, application, and platform. That way if an attacker does manage to crack one account, they won’t be able to crack them all. When it comes to creating multiple passwords, using a free password generator such as LastPass, F-Secure, or Avast can be quite helpful. This is especially true if you are replacing all of your passwords every six months as recommended by cybersecurity professionals such as ORAM Cybersecurity Advisors.Finally, employers should subscribe to a password manager and require all employees to utilize it. There are different subscription services for password managers available based on your business needs. Simply speak with your IT department or consult your third-party IT and cybersecurity provider such as ORAM.If you need assistance securing your business against brute force attacks, training employees in cybersecurity best practices, or employing any of the above mechanisms for shoring up cybersecurity, contact ORAM Cybersecurity Advisors at (617) 933-5060.