Brute-Force Attack
A trial-and-error method used by application programs to decode encrypted data such as passwords or DES keys.
Detailed Explanation
In a brute-force attack, an automated script tries every possible combination of characters until it finds the correct one. While simple, it is highly effective against weak passwords. Defenses include enforcing strong password policies, using account lockouts after multiple failed attempts, and implementing Rate Limiting and Multi-Factor Authentication.
Quick Summary
A brute-force attack systematically tries every possible value, password, key, token, until one works. It's stopped not by complexity alone but by making each guess slow, costly, or limited.
Key Takeaways
- Effectiveness scales with the keyspace: an 8-char lowercase password falls in hours; a 16-char mixed one is computationally infeasible.
- Credential stuffing is a smarter variant, attackers replay leaked username/password pairs from other breaches instead of guessing blindly.
- Defenses layer: strong password policy + per-account lockout + per-IP rate limit + MFA + breach-password checks.
- Slow hash functions (bcrypt, argon2) make offline brute-force expensive even if the password database leaks.
- Account lockout alone is a footgun, attackers can lock out real users (denial-of-service) by guessing their accounts.
When to use it
- Modeling attacker cost when choosing password policies or hash work factors.
- Detecting login anomalies (many failures from one IP, or one user from many IPs).
- Justifying MFA rollout: even weak passwords survive brute force when paired with a second factor.
Common Mistakes
- Relying only on password complexity rules; users respond with predictable patterns (`Password1!`) that crack quickly.
- Lockout policies with no IP-side limit, attackers spread attempts across accounts to avoid tripping any single lock.
- Storing passwords with fast hashes (MD5, SHA-1, single-round SHA-256), modern GPUs brute-force billions per second.
Brute-Force Attack, Frequently Asked
How long does a brute-force attack really take?
It depends on the hash and the keyspace. A leaked SHA-1 database of 8-char passwords falls in minutes on a single GPU. The same database hashed with bcrypt at cost 12 takes years. Slow hashing is what buys you time.
Is account lockout enough?
No. It only stops online guessing against one account, and attackers can weaponize it to lock out real users. Pair it with IP-based rate limits, MFA, and breach-password rejection.