Brute Force Attack
What is it and how can we defend against them
A brute force attack is a method used by cybercriminals to gain unauthorised access to systems, accounts, or encrypted data by systematically trying every possible combination of passwords or encryption keys until the correct one is found. It’s one of the simplest and oldest forms of cyberattacks, relying on trial and error rather than exploiting software vulnerabilities.
Here's how it works:
- The attacker uses a program or script that automatically and rapidly tries many combinations.
- It continues until it finds the correct one that grants access.
- This method doesn’t rely on clever tricks or vulnerabilities—just persistence and computing power.
Types of brute force attacks:
- Simple brute force: Tries every possible combination (e.g.,
aaaa,aaab,aaac, etc.). - Dictionary attack: Uses a list of likely passwords (like common words or leaked passwords).
- Hybrid attack: Combines dictionary words with variations (e.g.,
password123,admin!, etc.). - Credential stuffing: Uses leaked username-password pairs from other breaches.
Why it’s dangerous:
Brute force attacks can lead to:
- Unauthorised access to personal or corporate accounts
- Data theft or loss
- Financial fraud
- System compromise
Defenses against brute force attacks:
- Strong passwords (long, complex, and unique)
- Account lockouts after several failed attempts
- Rate limiting login attempts
- CAPTCHAs
- Multi-factor authentication (MFA)