4 ms·
Rate limiting needs to take into account password spray attacks. Instead of iterating through a series of passwords for a given username, an attacker can iterat
by SturgeonsLaw 5y ago
Rate limiting needs to take into account password spray attacks. Instead of iterating through a series of passwords for a given username, an attacker can iterate through a series of usernames for a common password. Under a lot of rate limiting systems (including the default settings for RDP I believe) this will only count as one attempt on each user.
- justsomehnguy 5y ago> including the default settings for RDP I believe There is no 'default RDP settings'. It is the security settings of the server (if an attacker tries local accounts) or the domain. Default AD DS settings are pretty lax, but whoever runs the open RDP with a default security settings deserves what would happen to him. > this will only count as one attempt on each user Yes, because the lockout policies are applied for user accounts, not for source IPs. Though it can be mitigated with a couple of scripts, if needed.