Imagine that you’re trying to log into your account, but you receive a message saying that your account has been locked, too many failed attempts. You’re confused – this is the first time you’ve tried to log on today. You try again, but your account is still locked. You try to reset your password, but it’s too late. Someone else has already updated your details and you can no longer access your account. Let’s take a look at what a brute force attack is and how you can protect your password.
What is a brute force attack?
In cybersecurity, a brute force attack is when a hacker tries to access your account by “guessing” your password. They will try multiple combinations of your password until they get the correct one. This may seem like a tedious task, but it is very effective. Hackers will use tools to assist them during the password guessing process, and these tools can guess millions of times per second.
How does a brute force attack work?
Let’s look at how a hacker can execute a brute force attack:
- The hacker begins by using software that will try to guess your password repeatedly. These types of software allow many attempts at guessing the password in a short space of time. This technique can also be referred to as password guessing.
- Hackers also compile lists of the most common passwords to speed up the password guessing process. These lists are called “dictionary lists”. Examples of common passwords are “password123”, “123456”, or “qwerty”. This technique can also be referred to as a dictionary attack.
- When a hacker manages to crack the password for one account, they will try to log into other accounts using the same password. This is also known as credential stuffing. This is one of the main reasons why you should not use the same password across all your accounts.
While we have only discussed passwords, the attack is also applicable to passphrases, PINs, and encryption keys.
How can you protect your password from brute force attacks?
Fortunately, there are simple steps you can take to increase your protection against this attack. Here are a few suggestions:
- Use strong and complex passwords. You can increase the strength of your password by using uppercase, lowercase, numbers, and special characters in your password. Try to make your password as long as possible or use a passphrase instead.
- Use a unique password. Do NOT use the same password across multiple accounts. Always create a unique password for each of your accounts so that even if one password is known, the hacker cannot access your other accounts.
- Use MFA. If multifactor authentication (MFA) is available, use it! MFA adds a layer of protection to your account so that even if the hacker knows your password, they will still need to complete the second authentication step to log into your account.
- Limit login attempts. If the website allows you to set up a limit on the number of password attempts for your account, then use it. This will stop the hacker from accessing your account because they will be limited to the number of times they can guess before the account is locked.
- Change your password regularly. Try to change your password every few months just to make sure that you’re not using a password that was already breached. Cyberattacks can happen over an extended period before anyone is aware of it, so changing your password means that they can’t use your old password to access your account.
What should you do if your account is targeted?
If you suspect that someone is trying to brute force your account, follow these steps:
- Change your password: Reset the password of the potentially compromised account immediately. Remember to make your new password as complex and unique as possible.
- Enable multifactor authentication (MFA): If your account has the option to enable MFA, do it. This will add an authentication step in addition to your password.
- Lock your account: If there is an option to temporarily lock your account, then make sure to use it. This will give you time to secure your account without the risk of further login attempts.
- Monitor your account: Check the login activity to see if there have been any unauthorized attempts to access your account.
- Report it: Contact the company or institution managing your account as soon as possible. The company may have a support team who can assist with investigating the attack and prevent any further unauthorized access to your account.
- Secure your other accounts: This is particularly important if you’ve reused the same password for different accounts. Reset your passwords for any other accounts and this time, make it different to any other account’s password.
- Check for credential leaks: There are many tools that you can use to check if your email address or password has been compromised because of a data breach. Check if any of your accounts have been leaked and update the passwords accordingly.
- Run an antivirus scan: Run a full scan on your device just to make sure that nothing malicious was installed while the hacker was logged into your account.
Brute force attacks are a reminder of how simple tactics can be an easy entry for cybercriminals. As long as you follow these tips, you can help prevent your account being compromised by this cyberattack. Be secure!
