COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record
CAPEC-565
Password Spraying
In a Password Spraying attack, an adversary tries a small list (e.g. 3-5) of common or expected passwords, often matching the target's complexity policy, against a known list of user accounts to gain valid credentials. The adversary tries a particular password for each user account, before moving onto the next password in the list. This approach assists the adversary in remaining undetected by avoiding rapid or frequent account lockouts. The adversary may then reattempt the process with additional passwords, once enough time has passed to prevent inducing a lockout.
Abstraction
Detailed
Typical severity
High
Likelihood of attack
High
Understand the attack
What is this attack pattern?
In a Password Spraying attack, an adversary tries a small list (e.g. 3-5) of common or expected passwords, often matching the target's complexity policy, against a known list of user accounts to gain valid credentials. The adversary tries a particular password for each user account, before moving onto the next password in the list. This approach assists the adversary in remaining undetected by avoiding rapid or frequent account lockouts. The adversary may then reattempt the process with additional passwords, once enough time has passed to prevent inducing a lockout.
Extended description
Password Spraying attacks often target management services over commonly used ports such as SSH, FTP, Telnet, LDAP, Kerberos, MySQL, and more. Additional targets include Single Sign-On (SSO) or cloud-based applications/services that utilize federated authentication protocols, and externally facing applications. Successful execution of Password Spraying attacks usually lead to lateral movement within the target, which allows the adversary to impersonate the victim or execute any action that the victim is authorized to perform. If the password chosen by the user is commonly used or easily guessed, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.
Password Spraying Attacks are similar to Dictionary-based Password Attacks ( CAPEC-16 ) in that they both leverage precompiled lists (i.e. dictionaries) of username/password combinations to try against a system/application. The primary difference is that Password Spraying Attacks leverage a known list of user accounts and only try one password for each account before moving onto the next password. In contrast, Dictionary-based Password Attacks leverage unknown username/password combinations and are often executed offline against files containing hashed credentials, where inducing an account lockout is not a concern.
Password Spraying Attacks are also similar to Credential Stuffing attacks ( CAPEC-600 ), since both utilize known user accounts and often attack the same targets. Credential Stuffing attacks, however, leverage known username/password combinations, whereas Password Spraying attacks have no insight into known username/password pairs. If a Password Spraying attack succeeds, it may additionally lead to Credential Stuffing attacks on different targets.
Execution flow
How does the attack proceed, step by step?
Explore
Determine target's password policy
Determine the password policies of the target system/application.
Techniques used
- Determine minimum and maximum allowed password lengths.
- Determine format of allowed passwords (whether they are required or allowed to contain numbers, special characters, etc., or whether they are allowed to contain words from the dictionary).
- Determine account lockout policy (a strict account lockout policy will prevent brute force attacks).
Select passwords
Pick the passwords to be used in the attack (e.g. commonly used passwords, passwords tailored to individual users, etc.)
Techniques used
- Select passwords based on common use or a particular user's additional details.
- Select passwords based on the target's password complexity policies.
Exploit
Brute force password
Given the finite space of possible passwords dictated by information determined in the previous steps, try each password for all known user accounts until the target grants access.
Techniques used
- Manually or automatically enter the first password for each known user account through the target's interface. In most systems, start with the shortest and simplest possible passwords, because most users tend to select such passwords if allowed to do so.
- Iterate through the remaining passwords for each known user account.
Requirements
What does the attack require?
Prerequisites
- The system/application uses one factor password based authentication.
- The system/application does not have a sound password policy that is being enforced.
- The system/application does not implement an effective password throttling mechanism.
- The adversary possesses a list of known user accounts on the target system/application.
Skills required
- Low: A Password Spraying attack is very straightforward. A variety of password cracking tools are widely available.
Resources required
- A machine with sufficient resources for the job (e.g. CPU, RAM, HD).
- Applicable password lists.
- A password cracking tool or a custom script that leverages the password list to launch the attack.
Detection
What are the indicators of the attack?
Many invalid login attempts are coming from the same machine (same IP address) or for multiple user accounts within short succession.
The login attempts use passwords that have been used previously by the user account in question.
Login attempts are originating from IP addresses or locations that are inconsistent with the user's normal IP addresses or locations.
Impact
What does a successful attack lead to?
Gain Privileges
Affected scopes: Confidentiality, Access Control, Authentication
Read Data
Affected scopes: Confidentiality, Authorization
Modify Data
Affected scopes: Integrity
Defence
How is it prevented and mitigated?
1
Create a strong password policy and ensure that your system enforces this policy.
2
Implement an intelligent password throttling mechanism. Care must be taken to assure that these mechanisms do not excessively enable account lockout attacks such as CAPEC-2 .
3
Leverage multi-factor authentication for all authentication services and prior to granting an entity access to the domain network.
Real world
MITRE example instances
Example instance 1Detail
A user selects the phrase "Password123" as their password, believing that it would be very difficult to guess. Password Spraying, leveraging a list of commonly used passwords, is used to crack this password and gain access to the account.
Example instance 2Detail
The Iranian hacker group APT33 (AKA Holmium, Refined Kitten, or Elfin) carried out numerous Password Spraying attacks in 2019. On average, APT33 targeted 2,000 organizations per month, with upwards of 10 million authentication attempts each day. The majority of these attacks targeted manufacturers, suppliers, or maintainers of industrial control system equipment.