What is a brute-force attack?¶
A brute-force attack is an attempt to discover valid authentication information by systematically trying many possibilities.
Avoid the dangerous assumption¶
The dangerous assumption is that any series of failed logins proves deliberate brute force.
Repeated failures can also come from forgotten passwords, misconfigured applications, expired credentials or automated systems.
A brute-force attack may target:
- one account with many passwords
- an encrypted file
- a password hash
- a recovery code
- another authentication secret.
Evidence may include:
- high-volume failed attempts
- regular or automated timing
- repeated requests against the same account
- changes in source infrastructure
- eventual successful access
- security alerts or account lockouts.
Investigators should establish whether the attempts were made against a live service or performed offline against copied credential material.
Offline cracking may leave little or no trace in the target service because the testing occurs elsewhere.
Ask for the full authentication sequence, not just the successful event. The pattern of failures may show method, duration and automation.
Do not assume the apparent source identifies the offender. Attempts may be routed through proxies, botnets, compromised devices or cloud infrastructure.
Also check whether rate limiting, account lockout or other controls changed the outcome. An attack may have been attempted but unsuccessful.
Report success carefully. “A successful login followed repeated failures” may be justified. “The attacker brute-forced the password” may require more evidence.
Also preserve lockout, throttling and challenge records. They may show what controls operated, whether the attempts were interrupted and why the attacker changed source, timing or method.
Operational takeaway¶
Assess the pattern, volume and outcome of authentication attempts, and distinguish deliberate brute force from user error, misconfiguration and offline password cracking.