Password Spraying vs Brute Force: Differences & Prevention

Password stealing is one of the easiest ways a bad actor can get access to your personal data. Every day, we see reports of social media accounts (be it Instagram, Facebook, or Snapchat) or other websites being hacked. The attackers use different methods to gain access to your password, and today we will look at Password Spraying and Brute Force.

Though platforms have developed protocols to improve security and mitigate risks, hackers always manage to identify loopholes and vulnerabilities to exploit them. But there are some measures that will protect you against Password Spraying and Brute Force attacks.

Most of them are simple to implement, and we think that they’re absolutely necessary for good online hygiene.

For those wondering what a brute force attack is, it is a technique hackers use to bombard the authentication server with a range of passwords for a specific account. They start with the simpler ones, say 123456 or password123, and move on to the more complex passwords until the actual credential is found.

Hackers basically use all possible character combinations, and this is achieved through a set of specialized tools.

But there’s a downside to it. When employing brute force attacks, it often takes a long time to identify the correct password. Also, if websites have additional security measures, say, it blocks accounts after a series of incorrect passwords, hackers find it difficult to use brute force.

Though a few attempts every hour won’t trigger an account block. Remember, just like websites enforce security measures, hackers, too, devise tricks to bypass these or find a vulnerability.

About password spraying, it is a type of brute force attack wherein, instead of targeting an account with a wide array of password combinations, hackers use the same password on different accounts.

This helps eliminate a common problem faced during a typical brute force attack, account blocking. Password spraying is highly unlikely to raise suspicion and is often found to be more successful than brute force.

It’s typically used when administrators set the default password. So, when hackers acquire the default password, they will try it out on different accounts, and users who haven’t changed theirs would be the first to lose account access.

How is Password Spraying different from Brute Force?

	Brute Force	Password Spraying
Definition	Using different password combinations for the same account	Using the same password combination for different accounts
Application	Works on servers with minimal security protocols	Employed when many users share the same password
Examples	Dunkin Donuts (2015), Alibaba (2016)	SolarWinds (2021)
Pros	Easier to perform	It avoids account lockout and doesn’t raise suspicion
Cons	It takes more time and can result in the account being blocked, thus negating all the efforts	Often quicker and has a higher success rate

How do I prevent password brute force attacks?

Brute force attacks work when there are minimal security measures or an identifiable loophole in place. In the absence of the two, hackers would find it difficult to employ brute force to find out the correct login credentials.

Here are a few tips that would help both the server administrators and users prevent brute force attacks:

Tips for administrators

• Block accounts after multiple failed attempts: Account lockout is the reliable method to mitigate a brute force attack. It could be temporary or permanent, but the former makes more sense. This prevents hackers from bombarding the servers and users don’t lose account access.
• Employ additional authentication measures: Many administrators prefer relying on additional authentication measures, say presenting a security question that was configured initially after a series of failed login attempts. This will stop the brute force attack.
• Blocking requests from specific IP addresses: When a website faces continuous attacks from a specific IP address or a group, often blocking them is the easiest solution. Though you might end up blocking a few legitimate users, it will at least keep others safe.
• Use different login URLs: Another tip recommended by experts is to sort users in batches and create different login URLs for each. This way, even if a particular server faces a brute force attack, others largely remain safe.
• Add CAPTCHAs: CAPTCHAs are an effective measure that helps differentiate between regular users and automated sign-ins. When presented with a CAPTCHA, a hacking tool would fail to proceed, thus stopping a brute force attack.

Tips for users

• Create stronger passwords: We can’t emphasize how important it is to create stronger passwords. Don’t go with simpler ones, say your name or even commonly used passwords. Stronger passwords may take years to crack. A good option is to use a reliable password manager.
• Longer passwords over complex ones: As per recent research, it’s significantly more difficult to identify a lengthier password using brute force than a shorter but more complex one. So, go with longer phrases. Don’t just add a number or character to it.
• Set up 2-FA: When available, it’s important to set up multi-factor authentication as it eliminates the over-reliance on passwords. This way, even if someone manages to acquire the password, they won’t be able to sign in without the additional authentication.
• Change the password regularly: Another tip is to regularly change the account password, preferably every few months. And do not use the same password for more than one account. Also, if any of your passwords feature in a leak, change it immediately.

Read more about this topic

• eScan antivirus compromised, GuptiMiner malware deployed through updates
• Here Are The Microsoft Graph Command Line Tools & Their Uses
• White House cyber policy director calls Microsoft a security threat

How do I protect against password spray attack?

When talking of Brute Force vs Password Spraying, preventive measures remain pretty much the same. Though since the latter works differently, a few additional tips might help.

• Force users to change the password after initial login: To mitigate the problem of password spraying, it’s imperative that administrators get users to change their initial passwords. As long as all users have different passwords, the attack won’t succeed.
• Allow users to paste passwords: Manually entering a complex password is a hassle for many. As per reports, users tend to create more complex passwords when allowed to paste or auto-input them. So make sure that the password field offers the functionality.
• Don’t force users to periodically change passwords: Users follow a pattern when asked to change their password periodically. And hackers can identify this easily. So, it’s important to let go of the practice and let users set a complex password in the first go.
• Configure the Show password feature: Another feature that prompts users to create complex passwords and prevents genuine failed sign-ins is when they can view the password before proceeding. So, make sure you have that set up.

Now that you know more about Password Spraying and Brute Force attacks, keep in mind that the best practice is to create stronger passwords, no matter the method.

This alone can prevent and block most of the vulnerabilities of your accounts. Pair that with an effective password manager, and that will solidify your security and ease of access even more.

You should be aware that an incredible number of passwords are hacked every day, and the only way to protect your data is through proper online hygiene and good preventive measures.

If you have any other tips that you want to share with the community, leave them in the comments section below.