Brute Force Attacks And How to Block Them

Introduction

As we know hackers are always attemting to access our password and userid or user name. In the present time of world hackers are very active hacking our password or username. Sometimes they use a Brute Force attack for hacking our information. Using a Brute Force attack a hacker makes very many attempts to get the user name and password until they are successful. Sometimes users use a simple password like 123456 or 098765 and the user name like admin or user. That type of password and username can be hacked easily. In a normal Brute Force attack hackers use a dictionary in which all the normal (commonly used) words and simple passwords are attempted for the user id and password to access the user account. On the other hand in a typical Brute Force attack hackers try every key combination to access the account. If the user uses a long password consisting of all possible characters like numbers, characters and special symbols then it is not easy to determine the password easily because for that a Brute Force algorithm takes a long time.

Brute Force Attack

A Brute Force attack is a method or an algorithm to determine a password or user name using an automatic process that the Brute Force attack can take depending on your password length and its complexity. If you have a long and complex password then maybe a Brute Force attack cannot access your password easily. A Brute Force attack works very qickly for short passwords but if the password has a long length then it is not easy to guess the password. The main problem that occurrs with a Brute Force attack is server memory problems because the hackers attempt many times to access your account through which many HTTP requests are generated at your server so the result of this is your server goes slow and there is unnecessary traffic at our site. Sometimes the server runs out of memory. The algorithm used in a Brute Force method is a MD5 and SHA algorithm. If our website has a user authentication process then the chances of Brute Force attack are increased at our site.

Hackers use many tools for Brute Force attacks. Using those tools there is an algorithm to guess the password automaticly or create the combination depending on the given length. Sometimes we make the proxy request process but it is not very successful because we understand that every HTTP request comes from a unique IP address so it is not a good idea to block an IP address to stop a Brute Force attack. Since we know hackers are very clever, sometimes they use those types of tools that always try a different user name and different password so by blocking the IP address we cannot stop the Brute Force Attack.

How Brute Force Attacks Work

A Brute Force Attack simply uses the cryptography algorithm. As we know hackers know that the password and user name are stored in a database. So when we attempt to login and our page request is sent from the server to the client machine hackers are more active to access the account. Hackers know that there is an encrypted key by which they can decrypt the code. So they attempt all possible combinations to unlock it. There is a computer program that runs automatically to get the password. The attackers use a high-performance computer that is very fast, in other words the computer is capable of performing a long calculation in seconds. The Brute Force attack works with a single digit, number, character and special symbol and goes high and makes the combinations and attempts to access the account until a combination does match successfully.



Role of key combination and length in the password

As I said previously, if you use a long password that has a good combination of characters, numbers and special symbols then that password is not easy to crack because it takes more time, maybe years. For example banks and other important units always notify you to change your password within a given time duration because they always suggest you make a password that has a good combination of characters, numbers and special symbols so they have an idea that this password cannot be hacked by the attackers in a given amount of time and before the time period they always inform you to change your password.

When we create the password we use the following combinations.

• Numbers (0 to 9) that are 10.

• Characters (A-Z or a-z); 26 upper-case letters and 26 lower-case letters, so that is a total 52.

• Special Symbols(!, @, ., #, $, %, ^, &,* and more) that are about 32 in count.

The formula that is used to count the number of combinations to attempt is the following:

Total Combinations = Possible character^{password length}

Algorithm Brute Force attack