Sciextor

Brute Force Attacks

A brute force attack is a type of cyberattack that involves trying many possible combinations of usernames and passwords to gain unauthorized access to a system or service.

Brute force attacks are usually automated and rely on tools or scripts that test different credentials until they find a match. Brute force attacks can target various types of systems, such as websites, email accounts, encryption keys, APIs, and remote desktop services.

Brute force attacks are one of the oldest and most common methods of hacking, but they are still effective and popular with cybercriminals.

Brute force attacks can have various impacts on the victims, such as data breaches, identity theft, ransomware infections, phishing campaigns, and financial losses.

Some statistics on Brute Force Attacks are

• According to Verizon’s Data Breach Investigations Report 2020, more than 80% of breaches that used hacking involved brute force or the use of lost or stolen credentials
• According to Abnormal Security, the volume of brute force attacks grew by 160% starting in May 2021 and ending in mid-June. This means that brute force attacks targeted 26% of all organizations per week on average during that period — more than double the rate (10%) for a typical week
• According to ESET, there were 206 billion RDP brute-force attacks in the last 4 months of 2021; an increase of 274% over the previous period
• According to Beaming, companies in the UK experienced on average 157,000 cyberattacks during the first quarter of 2020. This translates to more than one attack per minute. Furthermore, the rate of attack was 30% higher compared to the first quarter of 2019
• According to HackerOne, white hat hackers earned around $40 million in bounties in 2019. Six hackers surpassed $1 million in lifetime earnings in 2019

What can you do

• Use strong and unique passwords for each of your online accounts. A strong password should be at least 12 characters long, and include a mix of uppercase and lowercase letters, numbers, and symbols. A unique password means that you do not use the same password for more than one account. This way, even if one of your passwords is compromised, the rest of your accounts will remain safe. You can use a password manager to help you create and store your passwords securely
• Use two-factor authentication (2FA) or multi-factor authentication (MFA) whenever possible. 2FA or MFA adds an extra layer of security to your login process, by requiring you to enter a code, a fingerprint, a face scan, or another factor, in addition to your password. This way, even if a hacker guesses or steals your password, they will not be able to access your account without the second or third factor. You can use an app like Authy or Google Authenticator to generate codes for 2FA or MFA
• Limit the number of login attempts and use account lockouts. You can configure your website or service to limit the number of login attempts that a user can make within a certain period of time, and lock out the account if the limit is exceeded. This way, you can prevent brute force attacks from trying many passwords in a short time. You can also use CAPTCHA or reCAPTCHA to verify that the user is human and not a bot
• Change the default port and username for your services. You can make it harder for brute force attacks to target your services, such as SSH, FTP, or RDP, by changing the default port and username that they use. For example, instead of using port 22 for SSH, you can use port 2222 or another random port. Instead of using “admin” or “root” as your username, you can use a different name that is not easy to guess. This way, you can reduce the chances of brute force attacks finding your services and credentials
• Use a firewall and a VPN to protect your network. You can use a firewall to block or filter unwanted traffic and requests from reaching your network or device. You can also use a VPN (Virtual Private Network) to encrypt your online traffic and hide your IP address and location from hackers and trackers. A VPN also allows you to access geo-restricted content and bypass censorship. You can choose a firewall and a VPN service that suits your needs and budget, and make sure to read the reviews and ratings before you sign up