| Name |
Dictionary-based Password Attack |
|
| Likelyhood of attack |
Typical severity |
| Medium |
High |
|
| Summary |
An attacker tries each of the words in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user was a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.
Dictionary Attacks differ from similar attacks such as Password Spraying (CAPEC-565) and Credential Stuffing (CAPEC-600), since they leverage unknown username/password combinations and don't care about inducing account lockouts. |
| Prerequisites |
The system uses one factor password based authentication. The system does not have a sound password policy that is being enforced. The system does not implement an effective password throttling mechanism. |
| Execution Flow |
| Step |
Phase |
Description |
Techniques |
| 1 |
Explore |
[Determine application's/system's password policy] Determine the password policies of the target application/system. |
- Determine minimum and maximum allowed password lengths.
- Determine format of allowed passwords (whether they are required or allowed to contain numbers, special characters, etc., or whether they are allowed to contain words from the dictionary).
- Determine account lockout policy (a strict account lockout policy will prevent brute force attacks).
|
| 2 |
Explore |
[Select dictionaries] Pick the dictionaries to be used in the attack (e.g. different languages, specific terminology, etc.) |
- Select dictionary based on particular users' preferred languages.
- Select dictionary based on the application/system's supported languages.
|
| 3 |
Explore |
[Determine username(s) to target] Determine username(s) whose passwords to crack. |
- Obtain username(s) by sniffing network packets.
- Obtain username(s) by querying application/system (e.g. if upon a failed login attempt, the system indicates whether the entered username was valid or not)
- Obtain usernames from filesystem (e.g. list of directories in C:\Documents and Settings\ in Windows, and list in /etc/passwd in UNIX-like systems)
|
| 4 |
Exploit |
[Use dictionary to crack passwords.] Use a password cracking tool that will leverage the dictionary to feed passwords to the system and see if they work. |
- Try all words in the dictionary, as well as common misspellings of the words as passwords for the chosen username(s).
- Try common combinations of words in the dictionary, as well as common misspellings of the combinations as passwords for the chosen username(s).
|
|
| Solutions | Create a strong password policy and ensure that your system enforces this policy. Implement an intelligent password throttling mechanism. Care must be taken to assure that these mechanisms do not excessively enable account lockout attacks such as CAPEC-2. Leverage multi-factor authentication for all authentication services. |
| Related Weaknesses |
|
CWE ID
|
Description
|
| CWE-262 |
Not Using Password Aging |
| CWE-263 |
Password Aging with Long Expiration |
| CWE-307 |
Improper Restriction of Excessive Authentication Attempts |
| CWE-308 |
Use of Single-factor Authentication |
| CWE-309 |
Use of Password System for Primary Authentication |
| CWE-521 |
Weak Password Requirements |
| CWE-654 |
Reliance on a Single Factor in a Security Decision |
|
| Related CAPECS |
|
CAPEC ID
|
Description
|
| CAPEC-49 |
An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password. |
| CAPEC-151 |
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. |
| CAPEC-560 |
An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service. |
| CAPEC-561 |
An adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain. |
| CAPEC-600 |
An adversary tries known username/password combinations against different systems, applications, or services to gain additional authenticated access. Credential Stuffing attacks rely upon the fact that many users leverage the same username/password combination for multiple systems, applications, and services. |
| CAPEC-653 |
An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System. |
|