In a Password Spraying attack, an adversary tries a small list (e.g. 3-5) of common or expected passwords, often matching the target's complexity policy, against a known list of user accounts to gain valid credentials. The adversary tries a particular password for each user account, before moving onto the next password in the list. This approach assists the adversary in remaining undetected by avoiding rapid or frequent account lockouts. The adversary may then reattempt the process with additional passwords, once enough time has passed to prevent inducing a lockout.

Execution Flow

1) Explore

[Determine target's password policy] Determine the password policies of the target system/application.

Technique

• Determine minimum and maximum allowed password lengths.
• Determine format of allowed passwords (whether they are required or allowed to contain numbers, special characters, etc., or whether they are allowed to contain words from the dictionary).
• Determine account lockout policy (a strict account lockout policy will prevent brute force attacks).

2) Explore

[Select passwords] Pick the passwords to be used in the attack (e.g. commonly used passwords, passwords tailored to individual users, etc.)

Technique

• Select passwords based on common use or a particular user's additional details.
• Select passwords based on the target's password complexity policies.

3) Exploit

[Brute force password] Given the finite space of possible passwords dictated by information determined in the previous steps, try each password for all known user accounts until the target grants access.

Technique

• Manually or automatically enter the first password for each known user account through the target's interface. In most systems, start with the shortest and simplest possible passwords, because most users tend to select such passwords if allowed to do so.
• Iterate through the remaining passwords for each known user account.

Prerequisites

The system/application uses one factor password based authentication.
The system/application does not have a sound password policy that is being enforced.
The system/application does not implement an effective password throttling mechanism.
The adversary possesses a list of known user accounts on the target system/application.

Skills Required

A Password Spraying attack is very straightforward. A variety of password cracking tools are widely available.

Resources Required

A machine with sufficient resources for the job (e.g. CPU, RAM, HD).
Applicable password lists.
A password cracking tool or a custom script that leverages the password list to launch the attack.

Mitigations

Create a strong password policy and ensure that your system enforces this policy.
Implement an intelligent password throttling mechanism. Care must be taken to assure that these mechanisms do not excessively enable account lockout attacks such as CAPEC-2.
Leverage multi-factor authentication for all authentication services and prior to granting an entity access to the domain network.

Related Weaknesses

References

REF-565

ACSC Releases Advisory on Password Spraying Attacks
https://www.us-cert.gov/ncas/current-activity/2019/08/08/acsc-releases-advisory-password-spraying-attacks

REF-566

A notorious Iranian hacking crew is targeting industrial control systems
Andy Greenberg.
https://arstechnica.com/information-technology/2019/11/a-notorious-iranian-hacking-crew-is-targeting-industrial-control-systems/

REF-567

Alert (TA18-086A): Brute Force Attacks Conducted by Cyber Actors
https://www.us-cert.gov/ncas/alerts/TA18-086A

Submission

Modifications