Decoding the Password Spraying Threat: What You Need to Know.

What Is Password Spraying?

In a password spraying attack, the basic premise involves an unauthorised user or hacker applying a commonly used password across several accounts within the same application. The strategy behind this type of attack is to bypass the mechanism that locks accounts after a certain number of failed login attempts. This is typically what happens in a brute force attack, where an attacker attempts to gain access to a single account by trying a wide variety of passwords.

The method of a password spraying attack is notably different. Rather than targeting a single account with numerous passwords, the attacker uses one password – usually a frequently used or a low-strength one – against multiple accounts. This technique of spreading the attempts allows the attacker to avoid immediate detection and the account lockout security measure, giving more time to breach the system.

Password spraying attacks prove especially successful against organisations that engage in password sharing. These businesses are prone to this type of attack because the use of shared passwords across multiple accounts increases the probability of gaining unauthorised access. It is essential, therefore, for organisations to adopt strict password policies and discourage password sharing to safeguard their systems against such threats.

How do Password Spraying Attacks Work?

A password spraying attack unfolds in a two-phase process. the first phase, the attacker procures a list of usernames associated with a target system. This could be a list of employees in a company, subscribers to a service, or any group of users associated with a particular system. Once this list is acquired, the attacker initiates the second phase, which is the actual ‘spray’ of the attack. Instead of trying a multitude of different passwords on a single account (which can trigger account-lock mechanics), they attempt to sign in to each of the usernames on the acquired list using a single, commonly used password.

If this attempt proves unsuccessful, the attacker doesn’t simply give up. They continue with the process, switching to a new commonly used password and once again attempting to log in across all usernames. This cycle continues, with the perpetrator rotating the password while persistently trying to breach the accounts. They maintain this approach until finally, they succeed in breaching the target’s authentication system.

Once inside, the intruder gains access not only to the breached accounts but potentially to the system these accounts belong to. This can lead to serious security threats including data theft, system damage, or other malicious activities depending on the attacker’s intent. With access to multiple accounts, they could potentially remain undetected within the system for an extended period of time, leading to even more significant damage.

How to identify potential Password Spraying Attacks?

Frequent, unsuccessful attempts at accessing different accounts are typical indicators of password spraying attacks. Organisations can identify signs of malicious activity by inspecting the authentication logs, particularly looking for system and application login failures associated with legitimate accounts.

Overall, the main signs to look out for are:

• A high volume of login activity within a short period.
• A spike in failed login attempts by active users.
• Logins from non-existent or inactive accounts.

 

 

That being said, the best way to prevent a password spray attack and to buy your company time to evaluate phishing resistant passwordless MFA solutions is to implement a solution similar to MyID PSM. This will enforce strong passwords for all of your active directory managed employees, check against the world’s largest password breach database to ensure all passwords used by your company have not been breached in real-time as well as alerting to any use of a breached password and enforcing the change of these passwords. By having this safety net, it allows companies to trial and rollout passwordless MFA, with a solution such as MyID MFA, at their own speed.

If you want to better protect your organisations sensitive data against attacks, contact Intercede today and arrange a free audit to identify your weaknesses and book in for a demo of MyID PSM to see how we can protect you going forward.