Brute-force attacks are still a major threat

In 2017, both the UK and Scottish Parliaments fell victim to brute-force attacks. One year later, a similar but unsuccessful attack occurred in the Northern Irish Assembly. And this year, Hong Kong’s Cathay Pacific suffered a brute-force attack and was fined £500,000 [~$630,000] by the UK’s data regulator for lacking sufficient preventative measures. The ad-blocking service AdGuard also forced a password reset on all its users after suffering a brute-force attack.

According to Verizon’s 2020 Data Breach Investigations Report, hacking, which includes brute forcing passwords, remains the primary attack vector. Over 80% of breaches caused by hacking involve brute force or the use of lost or stolen credentials.

For months now, we have heard about the increasing number of phishing emails attempting to take advantage of people’s fears amid the pandemic. Now, a growing number of brute-force attacks is threatening business networks around the globe.

What is a brute-force attack?

A brute-force attack (also known as brute-force cracking) is a method of trying every possible password until the right one is found. These attacks are done by ‘brute force’, meaning they use excessive forceful attempts to ‘force’ their way into private accounts. This attack method is old, but still effective and popular with hackers. Gaining access to a valid account can mean compromising the entire site, which bad actors can then use as part of their network of compromised websites.

”Unlike many other tactics used by bad actors, brute-force attacks don’t rely on vulnerabilities within websites. Instead, they rely on users having weak or guessable credentials. The simplicity and number of potential targets make brute-force attacks very popular,” says Juta Gurinaviciute, Chief Technology Officer at NordVPN Teams.

Brute-force attacks are often used to target devices on remote networks to obtain personal information, such as passwords, passphrases, usernames, personal identification numbers (PINs), and emails. Hackers will then attempt to profit from the access by spamming, distributing malware, or phishing unsuspecting victims.

“There is little finesse involved in a brute-force attack, so attackers can run several attacks in parallel to increase their chances of success,” adds Ms. Gurinaviciute.

Increasing attacks on Windows’ remote desktop protocol (RDP)

With the rise of remote work due to COVID-19, many brute-force attacks have been attempting to exploit the Windows remote desktop protocol (RDP), used by network administrators to remotely manage Windows systems.

According to Kaspersky’s observation, whether it is China, Italy, the United States, Spain, Germany, France, or Russia, there has clearly been an increase in the number of RDP brute-force attacks since mid-March this year. For example, the number of attacks in the US amounted to around 200,000 before the pandemic and surpassed 800,000 in mid-March. In April, it reached 1.4 million.

“It comes as no surprise that bad actors now direct brute-force attacks towards individuals. Users working from home don’t have the extra layers of protection provided by their offices or enterprise systems, making them much easier targets. Many users also choose weak passwords, which are relatively easy to compromise using simple brute-force techniques,” comments Juta Gurinaviciute, Chief Technology Officer at NordVPN Teams.

How to protect your company against brute-force attacks

Catching and neutralizing a brute-force attack in progress is the best option — once attackers have access to the network, they’re much harder to catch. Once you detect and stop the attack, you can even block or blacklist IP addresses and prevent further attacks from the same computer.

Common sense is also important in identifying brute-force attempts. If it appears that someone is repeatedly and unsuccessfully trying to log in to an account, it is likely an attempted brute-force attack. The signs can include: the same IP address unsuccessfully trying to log in multiple times; many different IP addresses unsuccessfully trying to log in to a single account; multiple unsuccessful login attempts from various IP addresses in a short time period.

”Some attacks can take weeks or even months to provide anything usable. Most of the defenses against brute-force attacks involve increasing the time required for the attack to succeed. Avoiding brute-force attacks can simply be a matter of changing the company’s online habits, like using stronger passwords and not reusing them, or updating easy-to-guess URLs. Enforcing user locking after a few unsuccessful password attempts may also help to mitigate the attack at an early stage,” says the NordVPN Teams expert.

Organizations may also want to improve security by setting up two-factor or multiple-factor authentication, putting the website behind a web application firewall (WAF), installing a virtual private network (VPN) gateway to broker all RDP connections from outside their local network, and encrypting data on devices used for work. Above all, companies should take the time to train employees on the basics of digital security.