| Name |
Password Spraying |
|
| Likelyhood of attack |
Typical severity |
| High |
High |
|
| Summary |
In a Password Spraying attack, an adversary tries a small list (e.g. 3-5) of common or expected passwords, often matching the target's complexity policy, against a known list of user accounts to gain valid credentials. The adversary tries a particular password for each user account, before moving onto the next password in the list. This approach assists the adversary in remaining undetected by avoiding rapid or frequent account lockouts. The adversary may then reattempt the process with additional passwords, once enough time has passed to prevent inducing a lockout. |
| Prerequisites |
The system/application uses one factor password based authentication. The system/application does not have a sound password policy that is being enforced. The system/application does not implement an effective password throttling mechanism. The adversary possesses a list of known user accounts on the target system/application. |
| Execution Flow |
| Step |
Phase |
Description |
Techniques |
| 1 |
Explore |
[Determine target's password policy] Determine the password policies of the target system/application. |
- Determine minimum and maximum allowed password lengths.
- Determine format of allowed passwords (whether they are required or allowed to contain numbers, special characters, etc., or whether they are allowed to contain words from the dictionary).
- Determine account lockout policy (a strict account lockout policy will prevent brute force attacks).
|
| 2 |
Explore |
[Select passwords] Pick the passwords to be used in the attack (e.g. commonly used passwords, passwords tailored to individual users, etc.) |
- Select passwords based on common use or a particular user's additional details.
- Select passwords based on the target's password complexity policies.
|
| 3 |
Exploit |
[Brute force password] Given the finite space of possible passwords dictated by information determined in the previous steps, try each password for all known user accounts until the target grants access. |
- Manually or automatically enter the first password for each known user account through the target's interface. In most systems, start with the shortest and simplest possible passwords, because most users tend to select such passwords if allowed to do so.
- Iterate through the remaining passwords for each known user account.
|
|
| Solutions | Create a strong password policy and ensure that your system enforces this policy. Implement an intelligent password throttling mechanism. Care must be taken to assure that these mechanisms do not excessively enable account lockout attacks such as CAPEC-2. Leverage multi-factor authentication for all authentication services and prior to granting an entity access to the domain network. |
| Related Weaknesses |
|
CWE ID
|
Description
|
| CWE-262 |
Not Using Password Aging |
| CWE-263 |
Password Aging with Long Expiration |
| CWE-307 |
Improper Restriction of Excessive Authentication Attempts |
| CWE-308 |
Use of Single-factor Authentication |
| CWE-309 |
Use of Password System for Primary Authentication |
| CWE-521 |
Weak Password Requirements |
| CWE-654 |
Reliance on a Single Factor in a Security Decision |
|
| Related CAPECS |
|
CAPEC ID
|
Description
|
| CAPEC-49 |
An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password. |
| CAPEC-151 |
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. |
| CAPEC-560 |
An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service. |
| CAPEC-561 |
An adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain. |
| CAPEC-600 |
An adversary tries known username/password combinations against different systems, applications, or services to gain additional authenticated access. Credential Stuffing attacks rely upon the fact that many users leverage the same username/password combination for multiple systems, applications, and services. |
| CAPEC-653 |
An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System. |
|
| Taxonomy: ATTACK |
|
Entry ID
|
Entry Name
|
| 1110.003 |
Brute Force:Password Spraying |
|