- In 8.3, we're gonna focus in on brute force attacks.
And we'll start by describing what is a brute force attack.
A brute force approach to a problem
leverages those qualities of being a brute,
kinda strength and power,
while being bound by its limitations
of resource and discovery.
Now an advantage of brute force
is that it's generally simple to implement.
Now an advantage, obviously,
from an adversary's perspective,
not ours.
And if unimpeded will eventually succeed.
Now work factor...
That term's gonna come up again.
Work factor is the estimate of the time, effort,
and resources needed by an adversary to succeed.
A cyber brute force attack
is just this incredibly exhaustive approach
to performing an attack against a system,
a service, or a dataset.
Just doing it again and again and again, right?
It's brute force.
Now a cyber brute force attack,
it's almost always going to be automated
and it's performed via a script or an executable
that performs a fairly simple operation
or sequence of operations on a repeating loop.
Now, the attacks can be performed live online
or offline against an acquired dataset.
And cyber brute force attacks generally require
a significant amount of time
'cause we're doing it over and over and over again,
and computing resources.
So let's look at a couple of brute force approaches.
One approach is known as conduct.
In the conduct brute force approach,
the payload of the attack itself
is the conduct of the attack, right?
So example would be a denial of service attack, right?
Actually doing the brute force in and of itself, right?
Requesting access, requesting access,
requesting access, requesting access.
That in and of itself, right?
Is the attack.
The other is discovery,
and that's where the payload of the attack
is used to discover a hidden secret.
So for example, trying to discover a password.
Try an option one, try an option two
try an option three, try an option four
try an option five until you get the answer.
So it could either be conduct.
Meaning, the payload of the attack
is the conduct of the attack itself
or discovery where the payload of the attack
is used to discover a hidden secret.
So let's look at that second one a little bit more closely.
The common types of these discovery attacks
where we're trying to get a secret, right?
We're trying to discover something.
There are basic, dictionary, informed, and rainbow table.
In a basic, we're just really attempting
every single solution,
trying everything we can do to discover
whatever the secret is.
In a dictionary attack,
the adversary will use a finite reference list or dataset.
Maybe it's a common password list
because they're looking to discover a password.
So the most common passwords
or the most common words ever used in a password, right?
It's going to be a finite reference.
Where in a basic, we're not narrowing it down like that
or the adversary isn't narrowing it down like that.
Just trying everything,
trying everything,
trying everything.
An informed attack uses a known good reference list
or dataset.
A really good example is credential stuffing.
Now credential stuffing is when usernames
and passwords have been obtained.
Generally, they've been obtained
because a site's been compromised
and that information has been published
or sold out on the dark web.
So now I'm the adversary and I say,
"Okay, I've got sarah@greengroup.com
and I've got XYZ password."
I wonder if Sarah uses that username
and password anywhere else.
And so an informed attack,
they'd be using that known good list, right?
Username and password.
And trying it on lots of different other sites saying,
"I bet that she might reuse her password."
Because we know that people have a tendency
to reuse their passwords.
So that would be an example of informed,
using that known good reference list or dataset.
And then lastly, a rainbow table.
Now a rainbow table attack uses
a pre-computed table of hashes
to find the original plain text.
It's often used in password cracking
because in a number of systems,
passwords are transmitted not in clear text, hopefully,
not encrypted,
but the hash or the visual representation.
And when we talked about hashing earlier,
we said that we can go from our plain text to our hash
but we can never go back, right?
It's a one-way process.
I gave you the example of we make chicken nuggets
from chicken,
but we can never make a chicken from chicken nuggets.
So we can't reverse a hash.
But what we can do, right?
Is have a list of common words and their hashes
and compare them and do a comparison.
'Cause remember, every time we put that word through a hash,
it's going to come up with the exact same answer,
the same result.
So we can use the rainbow table
which is a pre-computed table of hashes.
So if I capture a hash, I can look and say,
"Okay, let me look down that list.
Oh, that hash is here.
Oh look, here's the reverse.
It's XYZ."
Now the most effective detective control
for identifying a brute force attack is going to be logging
and monitoring and alerting of both successful
and unsuccessful events.
So, you really wanna make sure
that your logs are set up to say,
"Okay, tell me when there's been a successful event."
But tell me when,
and probably more importantly here,
there's been an unsuccessful attempt.
Because in a brute force attack,
particularly in a discovery attack,
there will be a lot of unsuccessful attempts
before there's a successful attempt.
Now, what are some mitigation techniques we have
for brute force attacks?
We can do rate limiting
which is a technique to limit network traffic.
We can have account lockouts.
So let's say if the brute force attack
is against the password,
we can say, "Okay, you've got three tries
or four tries or five tries."
And then that's it, right?
The account is locked up.
We could require multi-factor authentication.
So, let's say we're trying to discover a password.
Well, if you have multifactor,
just knowing the password isn't gonna be enough.
And having intrusion prevention systems
so that we can see this malicious activity taking place
and put a stop to it.
And that, my friends, takes us to a three-second challenge.
Are you ready?
Five questions, three seconds each.
Let's do it.
This type of brute force attack attempts
every single solution.
1, 2, 3.
That's basic.
Number two, this type of attack uses a finite reference list
or data set.
1, 2, 3.
It's gonna be dictionary.
Number three, credential stuffing is an example
of this type of brute force attack.
1, 2, 3.
It's gonna be informed.
Number four, the estimate of time, effort, and resources
needed by an adversary to succeed.
What does that refer to as?
1, 2, 3.
And that's gonna be our work factor.
And lastly, number five.
The objective of this type of brute force attack
is a disruption of a resource.
1, 2, 3.
And that's gonna be a denial of service attack.
That's our disruption of a resource.
Good work.
I hope you did great on those.
All right, let's do a security-in-action
so we can apply our knowledge about brute force detection.
Your boss has requested
that your team enhance their brute force
authentication attack detection capabilities.
One of your colleagues responds
that the current logging of successful login attempts
is sufficient.
It's like, "We're good.
We don't need to do anything more."
My question to you is,
do you agree?
So once again, our bosses has requested
our team enhance their brute force
authentication attack detection capabilities.
And our colleague says, "Listen, we're logging.
We're logging successful login attempts.
We're good."
And my question to you,
do you agree?
Go ahead and put me on pause if you want
while you think about that.
Go on back and we'll do our response together.
So hopefully, you didn't agree
because logging of successful attempts is not sufficient.
By the time a successful attempt is identified,
the intruder's already in our system.
So logging should always be set to report both successful
and unsuccessful attempts.
And in addition, high priority alerts should be configured
if we see a pattern of unsuccessful attempts.
That make sense?
So we wanna just respectfully tell our colleague that,
"Nope, it's not sufficient and this is what we should do."
And importantly, we wanna educate our colleagues.
So explain why we're going to do both successful
and unsuccessful.
Doing that, my friends, is definitely security-in-action.
There you go.
There's your word cloud.
You know what to do.
No moving on until you can identify all of these terms.
When you're ready, head to the next lesson.
I'll be waiting for you right there.