Brute-force attack

What it means

A brute-force attack tries to gain access to an account or encrypted data by automatically testing huge numbers of password combinations until the right one is found. Attackers often use powerful computers or a botnet that tries passwords from many addresses at once.

Variants include dictionary attacks, which try common words and phrases, and password spraying, which tries one common password across many accounts. The related credential stuffing uses passwords stolen elsewhere.

How well the attack works depends on password length and complexity. A short password can be cracked in minutes, while a long random passphrase would take thousands of years.

How it works in practice

Basic protection is a password policy requiring long passwords, limits on failed attempts, temporary account lockout and above all two-factor authentication, so that a password alone is not enough.

Login interfaces such as email, VPN or website administration should record login attempts in audit logs. Many failed attempts signal an attack.

A password manager makes it possible to use a different long random password for each service without memorising it. For businesses it is a cheap measure with a big effect.

What to watch out for

Many companies leave legacy access unprotected, such as remote desktop exposed to the internet. That is a frequent brute-force target and a gateway for ransomware.

A successful attack may not be visible at once. The attacker can log in and quietly read emails, later sending a fake invoice with different bank details, so successful logins from unusual locations should be monitored too.