Okay, so you have worked hard, and now, all your organization passwords are strong, well managed, and regularly changed, so they are bullet-proof against Brute-Force attacks . They cannot be easily cracked, or at least it would require decades for automated hacking tools to crack them. So what's the problem now?
Well, the problem is precisely the operating mode of a "Brute-Force" attack: it is brutal, repetitive, harassing, and never-ending because of the use of automated tools. Even if your systems are not intruded, they are under constant attack (yes, they actually ARE: to convince you, browse your system event logs!). In the most intense cases, they will lead your system to a denial of service (DoS).
What is the problem?
Brute-Force attacks steal and abuse your resources
All types or computers, and especially web or backup servers, are targeted. The risk is even more pregnant if your server uses RDP or includes web pages requiring user authentication. These constant attacks abuse server resources, computers CPU, and your network bandwidth. These precious resources have a financial and human cost, and every brute-force attack can slow down the whole system, often dramatically.
A brute-force attack is terrible, because it can completely paralyze your entire system.
By flooding your server and/or website with unnecessary and costly traffic, we can observe the CPU of servers under attack jumping to 60% or 85% of usage! This is terrible, because it can completely paralyze your entire system and prevent everyone from working normally.
Once a computer or server is open to the outer world (even with only one open port), it becomes to be under attack. So that's why it is important that you implement tools to slow down these brute-force attacks, and reduce their quantity, intensity and frequency. These strategies will save on your infrastructure resources, and allow your organization to use them peacefully.
How to identify a Brute-Force attack?
Every attack leave traces that you have got to detect
96% of servers connected to the Internet (web, mail, backup) are under constant attack.
First, let's be clear: Probably you are under attack. Right now. Are you stumped? So double-check your server log files… If you take a closer look into your server's Security Event Logs, you will notice thousands of failed login attempts from a single IP address (and probably many others).
These connection attempts originate from automated bots trying to take control over your system, by RDP, or by harassing your "account" login screens, PhpMyAdmin, SQL Server administration tools, ESXi hosts or backup servers entry-points.
In the case you are using Wordpress, pay a close attention to XML-RPC (xmlrpc.php, or wp-includes/class-wp-xmlrpc-Server. php), as it is frequently targetted.
- Linux users could look the ssh log (/var/log/secure on Redhat, or /var/log/auth.log on Mandrake for example),
- Many other attempts may be logged in your HTTP layer and web server software logs (Apache, NGinx, IIS, Node.js…).
What you should look for into your log files are clues that may indicate a brute-force attack. First, particularly pay attention to failed logins attempts from the same IP, or login attempts coming from the same IP, but testing multiple usernames.
Reversing the previous pattern, login attempts to a specific account originating from several different IP addresses should warn you too : Who change its IP so frequently? (Answer: hackers bots do so!).
Additionally, alphabetically sequential usernames or passwords tested over and over again are also a clear proof that your service is under attack.
How to prevent, reduce, and stop them?
Countermeasures, tools and techniques to handle brute-force attacks
It is sometimes impossible to totally block or stop brute-force attacks. But you can set up a lot of side/alternatives countermeasures to slow them down, and even dissuade hackers to insist further. Each technique has its downsides, so please review carefully the strengths and weaknesses of each one.
- Do not send back "HTTP 401" error codes when a login attempt fails, but reply with "HTTP 200 Success" instead. This will deny hacking software this precious clue,
- Vary the HTTP headers you reply with on failed attempts: use sometimes 401 Unauthorized, 200 Success, 400 Bad Request, 404 Not Found, and other ones. This will confuse and muddy hacking software, stopping the worst ones, and slowing the best ones,
- Lock-down account when login failed a specific number of times within a predetermined timeframe. Beware of not setting up too strict policies at it may lead a user account to be constantly locked-down, leading it to be disabled and unusable (pay additional attention with Administrator logins, or prepare to close yourself the door to your very own nose!),
- Allow login only from specific IP addresses,
- Ban incriminated IP addresses for a certain numbers of hours or days,
- Upon a successful login, ask the user to answer its secret security question from time to time,
- Regularly change passwords! (every 2 to 4 months),
- Prevent automated attacks by using a CAPTCHA.
Expected benefits
An increasing number of hardware routers will allow you to block some of these attacks, and some routers even include subscriptions to global lists of malicious IP addresses (or ranges) that are banned directly at the source.
For login forms and customer areas, putting obstacles such as CAPTCHAs is a powerful way to slow them down, even completely stop a lot of them.
As none of these techniques will defeat 100% of brute-force attempts, they will have many benefits for you:
- It will harden the conditions on which such attacks can be performed by hackers,
- It will slow down good hackers,
- It will stop poor hackers,
- It will force hackers to leave more traces and clues, maybe allowing you to identify the attacker,
- It will free up resources on your infrastructure and systems.
How to handle RDP brute-force attacks?
If you are a fan of Remote Desktop Protocol (RDP) to control you computers remotely, however, intelligent hardware routers or other software will be required, because network scanners used by hackers and RDP Brute-Force tools are running 24/7! And they do scan EVERY port using an automated port-scanner, so if you thought that changing the default RDP port was a good protection...sorry to tell you that...No, it is not. FTP access and MSSQL DB login attempts are also very common and subject to constant login attempts. Connecting using a VPN is also highly recommended.
Fortunately, in addition to physical hardware routers, some security software can protect you against an abuse of your resources, and increase the peaceful life of your cherished strong passwords! Basically, this type of software will automatically prevent attackers from continuing to try getting credentials required to enter your system and take control over it.
We have listed for you some of the popular software that can help you fighting this curse, specifically over RDP login attempts, because this is one of the favorite access points that hackers are trying to get through. Please note that the following lists are not exhaustive, and other products and / or technical solutions may exist. We do not recommend any solution or any products specifically: we offer you these links for information purposes, in order to provide you with some starting point. Each System Administrator has to assess its needs and the solutions that may suit to the organization.
If you are running under a Windows-based environment:
Conclusion
Brute-force attacks are one of the basic and most-used techniques to crack passwords, but they are not the only one. Be sure to take a look at the other methods used by hackers to steal, crack, guess or deduce your password.
Why are long and complex passwords safer?
Constantly being prompted to choose a complex password is very annoying... but it was designed to protect you rather than annoy you: Discover why!
10 Common mistakes to avoid when choosing a password
Choosing a password can be a tedious task, and some caveats have to be clearly avoided to be well protected. Stay away from these 10 pitfalls to ensure that you choose a really secure password.
