According to Verizon’s 2020 Data Breach Investigations Report, hacking, which includes brute forcing passwords, remains the primary attack vector. Over 80% of breaches caused by hacking involve brute force or the use of lost or stolen credentials.

What Is a Brute-Force Attack?

A brute-force attack (also known as brute-force cracking) is a method of trying every possible password until the right one is found. These attacks are done by brute force, meaning they use excessive forceful attempts to force their way into private accounts. This attack method is old but still effective and popular with hackers. Gaining access to a valid account can mean compromising the entire site, which bad actors can then use as part of their network of compromised websites.

‘’Unlike many other tactics used by bad actors, brute-force attacks don’t rely on vulnerabilities within websites,” said Juta Gurinaviciute, CTO at NordVPN Teams. “Instead, they rely on users having weak or guessable credentials. The simplicity and number of potential targets make brute-force attacks very popular. Brute-force attacks are often used to target devices on remote networks to obtain personal information, such as passwords, passphrases, usernames, personal identification numbers (PINs), and emails. Hackers will then attempt to profit from the access by spamming, distributing malware, or phishing unsuspecting victims. There is little finesse involved in a brute-force attack, so attackers can run several attacks in parallel to increase their chances of success.”

With the rise of remote work due to COVID-19, many brute-force attacks have been attempting to exploit the Windows remote desktop protocol (RDP) used by network administrators to remotely manage Windows systems.

According to Kaspersky’s observation, whether it is China, Italy, the U.S., Spain, Germany, France, or Russia, there has clearly been an increase in the number of RDP brute-force attacks since mid-March this year. For example, the number of attacks in the U.S. amounted to around 200,000 before the pandemic and surpassed 800,000 in mid-March. In April, it reached 1.4 million.

“It comes as no surprise that bad actors now direct brute-force attacks toward individuals,” Gurinaviciute said. “Users working from home don’t have the extra layers of protection provided by their offices or enterprise systems, making them much easier targets. Many users also choose weak passwords, which are relatively easy to compromise using simple brute-force techniques.”

How To Stay Safe

Catching and neutralizing a brute-force attack in progress is the best option — once attackers have access to the network, they’re much harder to catch. Once detected, the attackers IP addresses can be blocked or blacklisted to prevent further attacks from the same computer.

Common sense is also important in identifying brute-force attempts. If it appears that someone is repeatedly and unsuccessfully trying to log in to an account, it is likely an attempted brute-force attack. The signs can include the same IP address unsuccessfully trying to log in multiple times, many different IP addresses unsuccessfully trying to log in to a single account, and multiple unsuccessful login attempts from various IP addresses in a short time period.

‘’Some attacks can take weeks or even months to provide anything usable,” Gurinaviciute said. “Most of the defenses against brute-force attacks involve increasing the time required for the attack to succeed. Avoiding brute-force attacks can simply be a matter of changing the company’s online habits, like using stronger passwords and not reusing them, or updating easy-to-guess URLs. Enforcing user locking after a few unsuccessful password attempts may also help to mitigate the attack at an early stage.”

Organizations may also want to improve security by setting up two-factor or multiple-factor authentication, putting the website behind a web application firewall (WAF), installing a virtual private network (VPN) gateway to broker all RDP connections from outside their local network, and encrypting data on devices used for work. Above all, companies should take the time to train employees on the basics of digital security.