Last week, U.S. News & World Report sat down with today’s top cybersecurity experts to discuss brute-force attacks, how this cybersecurity threat works, and best ways to protect yourself.
Known as one of the oldest types of attacks, brute force attacks are on the rise due to the shift to remote work. Hackers use trial-and-error to guess login info, encryption keys, or find a hidden web page, working through all types of combinations in hopes of guessing correctly – gaining access into a network.
The methods used in these attacks can range in difficulty, from simple brute-force attacks where hackers guess user credentials, to automated systems that make hundreds of guesses every second, to deploying networks of hijacked computers to execute the attack algorithm.
Regardless of the type of brute-force attack, monetary gain is often the primary motivation. Bluefin’s CISO, Brent Johnson, explains that today’s cyber thieves many have a multitude of reasons.
In reality, potential motives for brute-force attacks are endless. “The motive could be monetary related as sensitive data is readily sold on the dark web for things like identity theft,” says Johnson. “Perhaps a hacker is looking for confidential information to hold a company ransom, or maybe they’re simply trying to ruin a company’s reputation. Motives aren’t always readily apparent; hackers may try to brute force their way into a system just to see if they can.”
Motives may vary, but once the attack is successful, a hacker can wreak havoc inside a network until they are detected, using the time to steal data, install backdoors, and gain knowledge about the system for possible future hacks.
Hackers will continue with brute-force attacks, but Johnson states that there are steps you can take to protect yourself.
Using multifactor authentication (MFA) is critical. “MFA adds another layer of security to your password. Requiring a password in conjunction with biometrics or something you have, such as a unique token, helps to limit the effectiveness of brute-force attack,” Johnson says. Additionally, other steps, like setting up a “honey-pot” account may help. “These are fake account(s) that only a select few admins know about within an environment,” he explained. “These admins are alerted anytime someone tries to log in to that account. This method is effective in finding threat actors in your environment ‘password spraying’ user accounts trying to find a match.”
Read the full article here.
