4 ms·

Unmasking a slow and steady password spray attack

63 points by noleary 2y ago

Tractor8626 2y ago
Isn't this a normal thing for service exposed to the internet? How do you differentiate attack campaign from your everyday-business-as-usual hacking attempts?
giorgioz 2y ago
Interesting but from the article I haven't understood how they actually managed to group together the 24 Users Targeted in 1 Week and understood this was a malicious attack.
- petergs 2y ago
  Yeah agreed that there wasn’t much information there. Having investigated similar password spray attacks, I’m guessing they just looked at the entire set of failed Azure CLI logins from the same ASN (AS6939). Then that activity was distinct enough from usual activity in the tenant to suspect it’s part of the same campaign (no prior logins from AS6939, little to no legitimate use of Azure CLI, or the job profile of the targeted users doesn’t align with usage of Azure CLI).
- 4gotunameagain 2y ago
  It seems like marketing blogspam. Anyone can come up with multiple hypothetical scenarios and fixes, share it, and as we see reach hn front page.
- advisedwang 2y ago
  Probably look for other attacks from the same AS, geo-ip, or some other proxy of being from that one datacenter.
Liftyee 2y ago
From a non cybersec background, I'm surprised that attackers even bother trying these attacks where each account only gets 2 attempts. To me, the probability of getting a hit feels incredibly, unworkably low, unless there are lots of common passwords being used. I guess it's like most/all attacks under this category - the high potential payoff on success and near-zero cost to execute keep the EV positive.
- hansvm 2y ago
  The success rate is also likely pretty high. You're not necessarily restricted to just the entropy of a single password, but depending on the attack vector it can be conditioned on also knowing the account owner's identity or username/email. Combine that property with the insane payoff of uncappable Azure access, and this starts to look more attractive.
- SAI_Peregrinus 2y ago
  Usually they're trying username/password combinations that they got from some other breach. They figure people often re-use passwords, so using the same username & password on multiple sites to try to log in often works. That's what a "password spraying" attack is. Even if a breach forces people to change a password they've used on one site they'll often not change it on other sites, so this still tends to work.
  - jsnell 2y ago
    What you're describing is typically called credential stuffing. Password spraying is a distinct form of brute-forcing, where there is no link between the password and the user, and the yield is coming from the password being common.
    - SAI_Peregrinus 2y ago
      Right, I swapped them in my head. Thanks for the correction!
- ajb 2y ago
  Think about it this way: you are going to do N amount of work (password trials) either each against a different account, or all against the same account. Which is more likely to result in a break? If you try against the same account, for each trial you gain a (very small) piece of information (that the account does not use that password) which you can use in later trials, which seems like an advantage over trials against different accounts, where you don't gain this information. But we also know that there are a significant number of accounts using weak passwords. If you keep trying against the same account, you will try the weak (high probability) passwords first, but if they don't break the account then you will run out of those and have to try low probability ones. But if you try against different accounts, you can keep retesting the high probability passwords. So trying against a different account each time is almost certainly more efficient - as long as you don't care about which account you break.
yellow_lead 2y ago
That's great but why didn't you enable two factor authentication?
- hombre_fatal 2y ago
  The general solution against this attack is to generate random passwords for users, not force them into 2FA (for more annoying).
kazinator 2y ago
"Out of my 24 user accounts, all of whose names are known to attackers somehow, one got hacked after two attempts. So I think the best course of action is to write a blog about how clever I am with 'log slicing'."
grayhatter 2y ago
In the context of security, IPv6 has no meaningful granularity below /64. Seconds of research will also show how cheap it is to get a /48 as well. Everytime I see full IPv6 addresses as if they were meaningful at that resolution, I die just a little bit on the inside. Policy issues with filtering by country of origin aside; ASN would be a better filter here over country of origin. It's also unclear why using a /48 helps evade their indicators of compromise detection? > Takeaway: Looking at User Activity Timelines Isn’t Enough I mean, obviously? You'd only look at a users timeline if a user was compromised. Looking at users timeline looking for infra attacks is like studying the rings on a tree you just cut down, as a means to determine if the forest is on fire. As a whole this intro to security detection doesn't fill me with a ton of confidence... Everything here is exclusively superficial.
barbazoo 2y ago
https://owasp.org/www-community/attacks/Password_Spraying_Attack https://owasp.org/www-community/attacks/Password_Spraying_At... > Password spraying is a type of brute force attack. In this attack, an attacker will brute force logins based on list of usernames with default passwords on the application. For example, an attacker will use one password (say, Secure@123) against many different accounts on the application to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. > This attack can be found commonly where the application or admin sets a default password for the new users.
jsnell 2y ago
I'm not convinced. Password spraying attacks have a very low yield, and need high volume to compensate. 24 attempts per week is just not viable.
- Damogran6 2y ago
  You just need one.

63 points by noleary 2y ago

Isn't this a normal thing for service exposed to the internet? How do you differentiate attack campaign from your everyday-business-as-usual hacking attempts?

giorgioz 2y ago

Interesting but from the article I haven't understood how they actually managed to group together the 24 Users Targeted in 1 Week and understood this was a malicious attack.

petergs 2y ago
Yeah agreed that there wasn’t much information there. Having investigated similar password spray attacks, I’m guessing they just looked at the entire set of failed Azure CLI logins from the same ASN (AS6939). Then that activity was distinct enough from usual activity in the tenant to suspect it’s part of the same campaign (no prior logins from AS6939, little to no legitimate use of Azure CLI, or the job profile of the targeted users doesn’t align with usage of Azure CLI).
4gotunameagain 2y ago
It seems like marketing blogspam. Anyone can come up with multiple hypothetical scenarios and fixes, share it, and as we see reach hn front page.
advisedwang 2y ago
Probably look for other attacks from the same AS, geo-ip, or some other proxy of being from that one datacenter.

Liftyee 2y ago

From a non cybersec background, I'm surprised that attackers even bother trying these attacks where each account only gets 2 attempts. To me, the probability of getting a hit feels incredibly, unworkably low, unless there are lots of common passwords being used. I guess it's like most/all attacks under this category - the high potential payoff on success and near-zero cost to execute keep the EV positive.

hansvm 2y ago
The success rate is also likely pretty high. You're not necessarily restricted to just the entropy of a single password, but depending on the attack vector it can be conditioned on also knowing the account owner's identity or username/email. Combine that property with the insane payoff of uncappable Azure access, and this starts to look more attractive.
SAI_Peregrinus 2y ago
Usually they're trying username/password combinations that they got from some other breach. They figure people often re-use passwords, so using the same username & password on multiple sites to try to log in often works. That's what a "password spraying" attack is. Even if a breach forces people to change a password they've used on one site they'll often not change it on other sites, so this still tends to work.
- jsnell 2y ago
  What you're describing is typically called credential stuffing. Password spraying is a distinct form of brute-forcing, where there is no link between the password and the user, and the yield is coming from the password being common.
  - SAI_Peregrinus 2y ago
    Right, I swapped them in my head. Thanks for the correction!
ajb 2y ago
Think about it this way: you are going to do N amount of work (password trials) either each against a different account, or all against the same account. Which is more likely to result in a break? If you try against the same account, for each trial you gain a (very small) piece of information (that the account does not use that password) which you can use in later trials, which seems like an advantage over trials against different accounts, where you don't gain this information. But we also know that there are a significant number of accounts using weak passwords. If you keep trying against the same account, you will try the weak (high probability) passwords first, but if they don't break the account then you will run out of those and have to try low probability ones. But if you try against different accounts, you can keep retesting the high probability passwords. So trying against a different account each time is almost certainly more efficient - as long as you don't care about which account you break.

yellow_lead 2y ago

That's great but why didn't you enable two factor authentication?

hombre_fatal 2y ago
The general solution against this attack is to generate random passwords for users, not force them into 2FA (for more annoying).

kazinator 2y ago

"Out of my 24 user accounts, all of whose names are known to attackers somehow, one got hacked after two attempts. So I think the best course of action is to write a blog about how clever I am with 'log slicing'."

grayhatter 2y ago

In the context of security, IPv6 has no meaningful granularity below /64. Seconds of research will also show how cheap it is to get a /48 as well. Everytime I see full IPv6 addresses as if they were meaningful at that resolution, I die just a little bit on the inside. Policy issues with filtering by country of origin aside; ASN would be a better filter here over country of origin. It's also unclear why using a /48 helps evade their indicators of compromise detection? > Takeaway: Looking at User Activity Timelines Isn’t Enough I mean, obviously? You'd only look at a users timeline if a user was compromised. Looking at users timeline looking for infra attacks is like studying the rings on a tree you just cut down, as a means to determine if the forest is on fire. As a whole this intro to security detection doesn't fill me with a ton of confidence... Everything here is exclusively superficial.

barbazoo 2y ago

https://owasp.org/www-community/attacks/Password_Spraying_Attack https://owasp.org/www-community/attacks/Password_Spraying_At... > Password spraying is a type of brute force attack. In this attack, an attacker will brute force logins based on list of usernames with default passwords on the application. For example, an attacker will use one password (say, Secure@123) against many different accounts on the application to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. > This attack can be found commonly where the application or admin sets a default password for the new users.

jsnell 2y ago

I'm not convinced. Password spraying attacks have a very low yield, and need high volume to compensate. 24 attempts per week is just not viable.

Damogran6 2y ago
You just need one.