Attacks Targeting Passwords and Authentication

頻出~23 min4 terms8 past questions

Goals of this unit

Tell attacks in which the attacker generates and tries guesses apart from attacks that reuse real ID–password pairs leaked elsewhere.
Work out the maximum number of attempts an exhaustive search (総当たり) needs from the number of usable characters and the length.
Match each attack with the countermeasures that work against it and those that do little.

Terms at a glance (4)

Term	In one line	What is tried	Who is most exposed
辞書攻撃	Tries a list of commonly chosen words and strings one by one	A word list prepared by the attacker	People who use meaningful words as they are
ブルートフォース攻撃	Tries every combination of characters exhaustively	Every combination, generated mechanically	People with short passwords that use few character types
パスワードリスト攻撃	Tries ID–password pairs leaked elsewhere on a different site	Real pairs that were leaked	People who reuse the same pair across several sites
クレデンシャルスタッフィング	An English-derived name for the same technique as a password list attack	Real pairs that were leaked	People who reuse the same pair across several sites

辞書攻撃Dictionary attack

Open in glossary

A dictionary attack (辞書攻撃) guesses a password by trying, one after another, a list of words and strings that people tend to choose as passwords.

The attacker prepares only likely candidates such as names, English words and common number sequences, so a password can sometimes fall after only a few attempts. Strings that are not on the list never match, so choosing a random string over a meaningful word is an effective defense.

AnalogyIt is like a burglar hunting for a spare key who checks only the usual hiding spots, such as under the flowerpot or behind the mailbox, and ignores everywhere else.

How to rememberThe “dictionary” here is not a language dictionary but the attacker's own word book of commonly used passwords.

Exam points

ExamA dictionary attack (辞書攻撃) works out passwords from a word list, which sets it apart from a keylogger (キーロガー) that records keystrokes on the user's PC and steals them.
Mix-upA dictionary attack narrows its candidates to commonly used words, whereas a brute-force attack (ブルートフォース攻撃) tries every combination without narrowing.

1 past questions on this term 辞書攻撃

ブルートフォース攻撃Brute-force attack

Open in glossary

A brute-force attack (ブルートフォース攻撃) is an exhaustive search (総当たり) that works out a password by trying every combination of the usable characters in turn.

Length (36 characters: lowercase letters and digits)	Maximum attempts
1 character	36
2 characters	1,296 (36 × 36)
3 characters	46,656 (36 × 36 × 36)
Each extra character	36 times as many

Because it does not narrow its candidates, it reaches the correct password eventually if given enough time. With n usable characters and a length of k, the number of combinations is n to the power k (k factors of n multiplied together), so the attempts rise steeply as the length or the character set grows. A mechanism that temporarily disables an ID after a set number of consecutive wrong entries is called account lockout (アカウントロック).

AnalogyIt is like opening a three-digit combination lock by turning it through every number from 000 to 999.

How to remember“Brute force” means sheer force: the attack wins by numbers rather than by clever guessing.

Exam points

ExamWith n usable characters, each extra character multiplies the maximum number of attempts by n, and two extra characters multiply it by n squared.
ExamAccount lockout (アカウントロック) works well against a brute-force attack (ブルートフォース攻撃) because it cuts off a flood of attempts against a single ID partway through.

3 past questions on this term ブルートフォース攻撃

Dictionary attack vs. Brute-force attack

Aspect	Dictionary attack	Brute-force attack
Key differenceCandidates tried	Only a list of commonly chosen words	Every combination of characters
Number of attempts	Only as many as the list holds, so relatively few	Rises steeply with length and character types
Candidates left untried	Strings not on the list	None
Passwords most at risk	Meaningful words	Short ones with few character types

パスワードリスト攻撃Password list attack

Open in glossary

A password list attack (パスワードリスト攻撃) uses a list of ID–password pairs leaked elsewhere to try logging in to a different site.

IDs and passwords leak from Site X
The attacker obtains the list of pairs
The same pairs are entered on Site Y
Accounts that use the same pair are taken over

Only users who used the same pair on the other site are broken into at this step.

4 / 4

The attacker does no guessing and simply enters pairs that were actually in use. Damage spreads because a pair leaked from one site also works on any other site where the same pair is registered.

AnalogyIt is like someone who opens their house, car and locker with one key: if they drop it, whoever picks it up can open all three.

Exam points

ExamThe damage from a password list attack (パスワードリスト攻撃) comes from reusing (使い回す) the same ID and password across several sites.
ExamAccount lockout (アカウントロック), which stops an ID after repeated errors, does little against a password list attack, since that attack tries leaked pairs only a few times per ID.

2 past questions on this term パスワードリスト攻撃

Brute-force attack vs. Password list attack

Aspect	Brute-force attack	Password list attack
Key differenceWhat is tried	Mechanically generated combinations	Real pairs leaked elsewhere
Failures per ID	Many in a row	Few
Defenses that work	Account lockout; long, complex passwords	A different password for each site

クレデンシャルスタッフィングCredential stuffing

Open in glossary

Credential stuffing (クレデンシャルスタッフィング) tries leaked credentials (ID–password pairs) one after another on the logins of other sites, and it names the same technique as a password list attack.

Whichever name is used, the attack relies on real pairs leaked somewhere else. Tools often enter large numbers of pairs automatically, so a single leak can lead to unauthorized logins on many sites.

How to rememberCredential means login information and stuffing means cramming in: the name pictures leaked credentials being crammed into login boxes one after another.

Exam points

ExamCredential stuffing (クレデンシャルスタッフィング) and a password list attack (パスワードリスト攻撃) both mean breaking into a target site with ID–password pairs leaked elsewhere.

2 past questions on this term クレデンシャルスタッフィング

Key points

Dictionary and brute-force attacks have the attacker generate guesses, while a password list attack uses real leaked pairs as they are.
The maximum number of attempts in an exhaustive search equals the number of usable characters raised to the power of the password's length.
However long and complex a password is, if the same pair is also used on another site, a single leak from that site is enough to let an intruder in.

Check questions

5 past questions from this unit

Start the check questions

All past questions in this topic