Brute force attack

A Brute Force Attack also known as an Exhaustive Search is a method of cracking a password where every possible combination is tried. Because of this, brute force attacks are always successful, however, they usually take so much time, they're not worth using.

A mechanical example of a brute force attack is trying every possible combination on a combination lock. This is a tedious process because, with even a simple combination lock where the dial has only 30 places and the lock uses three numbers, would require 75 hours to check every combination if we assume it takes 10 seconds per attempt.

A similar system is used with password cracking on computers, where you first try password "a," then "b," and on to "z," then "aa," "ab," and so on. The number of passwords you need to try grows exponentially the longer the password gets.

Brute force attacks have legitimate uses, like when you've forgotten your password. However, they're mostly used for nefarious purposes.

Process

At its most basic level, a brute force attack is a three step process:

1. Generate the next password.
2. Try the password.
3. If the password was not successful, go to step 1.

Step 2 is the most difficult step because many systems purposely make it difficult to automate trying a password to prevent brute force attacks.

Accelerating the Process

In computer systems, passwords almost always allow the letters a-z, capital A-Z, numbers 0-9, and a host of special characters like !@#$%^&*. If we assume 100 possible characters, and the password is at most eight characters long, it means we will have to try 10,101,010,101,010,102 total passwords to guarantee a match. If we assume our PC can try 1,000,000,000 passwords a second, it will take about 116 days to try every password, and for a nine-character-long password, it would take over 32 years! So, why do password crackers even bother with brute force attacks? Because there are several ways to accelerate the process.

Trying Common Characters First

Unless the system requires an assortment of characters like a capital letter, number, or symbol, most users don't bother with them. Because of this, a brute force system can be setup to first try passwords made up of just the 26 lowercase letters, and only try more complex characters if it fails. This results in only 217,180,147,159 possible passwords, which, assuming 1,000,000,000 attempts can be made each second, would only take about 4 minutes for an 8-character-long password, and about 1.6 hours for a nine-character-long password.

Faster Hardware

1,000,000,000 passwords-a-second may seem impressive, but the latest hardware would increase that number significantly, and by taking advantage of multi-core processors and graphic cards, that number can be raised much higher. In fact, specialized hardware has been made just to crack passwords, and government or university super computers have also been used for the task, both of which process many times faster.

More Hardware

By distributing chunks of the passwords that need to tried across multiple computers, you can divide the necessary time for each new computer. When spanned across 100 computers, a brute force will be completed 100 times faster.

Defenses

There are several ways to protect against or slow down brute force attacks.

Control the Log In

The simplest and most effective method is to control the log in process. If you can control how a person logs in, you can add a delay after a failed attempt, lock the account after too many failures, and report when the failed attempts occurred. These methods make brute force attacks entirely unfeasible because they can make the already slow process take over a billion times longer. You will see this on website logins, ATMs, and OSes. However, this type of defense won't stop a cracker who can defeat your security, or acquire a copy of your data. For example, the Windows OS has a built-in delay on a failed password attempt, so brute forcing a password from the log in screen is unfeasible, but if someone has brief access to your PC while it is logged in, they can make a copy of the password file, run the brute force attack on their own computer, and determine your password.

It's possible to control the log in process even when it's not running on your PC. If a proprietary software package is built around encryption, the delay can be added to the program itself. Then, even if the file is copied, the cracker would still have to use the same program to decrypt it, which foils brute force attacks. In order to avoid the delay, the cracker would have to reverse engineer the program and recreate it without the delay, which is a tedious and complex process.

Longer Passwords

Since brute force attacks take exponentially longer to perform as the length of a password increases, each character you add to your password makes it vastly more secure from this type of attack.

Complex Characters

To prevent a simple brute force of just characters, it helps more than just lowercase letters in your passwords. Adding a symbol will make your password far less susceptible to brute force attacks. In particular, it helps to use a character not found on a keyboard, which many brute force attacks don't even bother with. These are not possible in many older systems, but most new systems allow them. To enter such a character, hold ALT on your keyboard, then type a number on the keypad (the numbers on the side not the top) and release ALT. For example, ALT+236 gives the character "∞" which will be given far less priority in a brute force attack.

Don't Verify Passwords

For many types of cryptography, the key is encrypted with the data, which means that the correct password can be verified. However, there are some types of encryption which do not store the key at all (like a One-Time Pad), so the only way to know if the password was correct is to look at the data and see if it contains what you are looking for. This process makes brute force attacks useless.

Links

• en.wikipedia.org/wiki/Brute-force_attack - Wikipedia.