CS406: Information Security

Bruteforce Attacks

Overview

• Brute force is defined as “trying every possible combination until the correct one is identified.”
• The most effective way to uncover passwords is through a hybrid attack, which combines a dictionary attack and a brute force attack
• A brute force attack is also known as an exhaustive attack.
• These are usually used for wardialing in hopes of finding a modem that can be exploited to gain unauthorized access.

Countermeasures

For phone brute force attacks, auditing and monitoring of this type of activity should be in place to uncover patterns that could indicate a wardialing attack:

• Perform brute force attacks to find weaknesses and hanging modems.
• Make sure only necessary phone numbers are made public.
• Provide stringent access control methods that would make brute force attacks less successful.
• Monitor and audit for such activity.
• Employ an IDS to watch for suspicious activity.
• Set lockout thresholds.

Source: https://en.wikibooks.org/wiki/Fundamentals_of_Information_Systems_Security/Access_Control_Systems#Bruteforce_Attacks 
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.