Tweet
An active online attack is a more aggressive and less stealth form of penetration that is designed to recover passwords.
Password Guessing
Password guessing is a crude but effective type of attack. An attacker seeks to recover a password by using words from a dictionary, by brute-force or by other means. This process is usually carried out using a password guessing tool designed to attempt hundreds or thousands of passwords each second. The tool tries all variations, including case changes, character substitutions, digit replacement, reverse case, amongst others. To refine this approach, an attacker may look for information about the victim, with the intention of discovering favorite pastimes or family names.
Password complexity goes a long way toward thwarting many of these types of attacks, because it makes the process of discovering a cleartext password slower and much more difficult.
Trojans, Spyware and Keyloggers
Malware such as Trojans, spyware and keyloggers can prove very useful during an attack by allowing the attacker to gather information of all types, including passwords. Keyboard sniffing or keyloggng, intercepts a password as the user enters it on the keyboard. This attack can be carried out when users are the victim of keylogging software or if they regularly log on to the system remotely without using any form of protection. Hardware keyloggers also exists and they are almost impossible to detect using protective software such as anti-virus software but are harder to put in place as it will require physical access to the target computer.
Hash Injection
This type of attack relies on the knowledge of hashing and on completing the following four steps:
Because of their extremely sensitive nature, passwords are not commonly stored in cleartext.
Password Guessing
Password guessing is a crude but effective type of attack. An attacker seeks to recover a password by using words from a dictionary, by brute-force or by other means. This process is usually carried out using a password guessing tool designed to attempt hundreds or thousands of passwords each second. The tool tries all variations, including case changes, character substitutions, digit replacement, reverse case, amongst others. To refine this approach, an attacker may look for information about the victim, with the intention of discovering favorite pastimes or family names.
Password complexity goes a long way toward thwarting many of these types of attacks, because it makes the process of discovering a cleartext password slower and much more difficult.
Trojans, Spyware and Keyloggers
Malware such as Trojans, spyware and keyloggers can prove very useful during an attack by allowing the attacker to gather information of all types, including passwords. Keyboard sniffing or keyloggng, intercepts a password as the user enters it on the keyboard. This attack can be carried out when users are the victim of keylogging software or if they regularly log on to the system remotely without using any form of protection. Hardware keyloggers also exists and they are almost impossible to detect using protective software such as anti-virus software but are harder to put in place as it will require physical access to the target computer.
Hash Injection
This type of attack relies on the knowledge of hashing and on completing the following four steps:
- Compromise a vulnerable workstation or desktop.
- When connected, attempt to extract the hashes from the target system for high-value users, such as domain or enterprise administrators.
- Use the extracted hash to log on to a server such as a domain controller
- If the system serves as a domain controller or similar, attempt to extract hashes from the system with the intention of exploiting other accounts
Because of their extremely sensitive nature, passwords are not commonly stored in cleartext.