What is brute force attack?

Theoretically, every string can be identified by a brute-force attack depending on the strength of the associated security strategy. This refers to certain access restrictions, like for example, limiting the number of entries. Alternatively, in case of many incorrect login attempts, further entries could be refused for a certain period of time.

Brute-force attacks can be implemented much faster without such security mechanisms in place. The two factors that basically determine the success of such an attack are the time available and the capabilities of the attacker’s hardware, which is largely responsible for the speed of the attack.

This method of attack, which some experts have described as redundant, is used increasingly by internet criminals. It is used to attack FTP hosts, ports and clients with an active release function for the remote desktop. In this case, a flood of attacks can be initiated in automated form. The attacker only has to define the framework conditions by specifying parameters.

The weakness lies in the password length. Most users are simply negligent when choosing their password combination. This is especially true for setting passwords for remote access. Often and for whatever reason, shallow as well as simple combinations of characters are chosen here in the form of names, dates of birth or strings of keyboard shortcuts. Users who do so, put themselves at a high security risk. Short password combinations of a four- to six-digit character length are particularly affected.

Here’s an example: For simplicity, employee A selects a four-digit password for remote desktop access that consists only of lowercase letters. Attacker X is aware that the security arrangements are only marginal in employee A’s company. For this reason, the attacker decides to check all small letter combinations of four characters length to get the password of employee A.

The resulting variants amount to 456,976, which mathematically corresponds to 26^4. Powerful hardware allows attacker X to gain the password of employee A in just a few seconds by setting the correct parameters in his brute-force software. If successful, the attacker gains full control of the system.

This example illustrates the relevance of the password length which every user should consider. The decryption time of the attacking software increases with an increased password length. The same applies to the additional use of large and small letters as well as numbers and special characters. It therefore seems advisable to use password keys that have more than 32 characters. For example, lengths of 256 and 512 bits are common. Here, the level of difficulty on the attacker’s side is significantly higher than with a shorter-length string.