Brute-force attacks in plain English
Think of a bike lock with four number dials. There are 10,000 possible combinations, from 0000 to 9999. Anyone with enough time can simply try them all – sooner or later, the lock pops open. That’s exactly what a brute-force attack is.
With passwords, a computer does the trying, and at tremendous speed. That’s why length matters most: every additional character multiplies the number of possible combinations. A short password is found quickly. With a long, random password or a passphrase made up of several randomly chosen words, on the other hand, pure trial and error is practically hopeless.
In practice, attackers rarely go about it completely blindly. They start with the most likely candidates: commonly used passwords, dictionary words, and typical patterns such as “CompanyName2026!” This is known as a dictionary attack.
How a brute-force attack works
There are two basic variants:
- Online attack: The attacker tries passwords directly against a login screen – for example, an online shop login, the VPN (the encrypted remote access to the corporate network), or Windows remote access via RDP (Remote Desktop Protocol) that is reachable from the internet. Every attempt travels over the network and can be detected, slowed down, or blocked.
- Offline attack: The attacker has already stolen stored passwords. These are usually not stored in plain text but as a hash – a kind of digital fingerprint that can’t simply be reversed to reveal the password. So the attacker calculates the hashes of many candidates and compares them. This happens on the attacker’s own computer: nobody notices the failed attempts, and no lockout kicks in. With weak hashing methods, powerful graphics cards can manage an enormous number of attempts per second.
There are also variations on the principle:
- In password spraying, the attacker tries a few common passwords against a very large number of accounts, staying below the threshold for account lockouts.
- In credential stuffing, the attacker tests credentials from earlier data breaches instead of guessing.
- In Kerberoasting, the attacker requests tickets for service accounts in a Windows network and then cracks their passwords offline.
A practical example
An engineering firm with 40 employees has made a Windows server directly accessible from the internet via RDP for remote work. Sign-in requires only a username and password. Every day, numerous failed login attempts from changing IP addresses show up in the logs, but nobody reviews them.
One of the accounts belongs to a former intern and was never deactivated. The password consists of her first name and a year. Eventually, the combination works, and the attacker is in the network – without having to exploit a single software vulnerability.
The firm takes action: the server is now reachable only via a VPN with multi-factor authentication, orphaned accounts are deactivated regularly, and repeated failed attempts now trigger an alert.
Why does this matter for businesses?
Brute-force attacks are cheap and run automatically around the clock. Every login that can be reached from the internet – online shop, customer portal, VPN, email, or remote access – should expect to be targeted. A single weak password can be enough for attackers to gain access to data, mailboxes, or the entire network.
For online shops and customer portals, there’s a second danger: hijacked customer accounts lead to fraud, complaints, and loss of trust. In addition, Art. 32 of the EU General Data Protection Regulation (GDPR) requires appropriate technical and organizational measures to protect personal data – and that includes effective protection of such accounts.
How to protect your organization
- Focus on length: Encourage long passwords and passphrases instead of complicated rules, and provide a password manager.
- Introduce multi-factor authentication: With MFA, a guessed password alone is no longer enough – especially important for remote access, email, and administration.
- Limit login attempts: Rate limiting allows only a few attempts per period of time. Combined with increasing wait times or temporary lockouts, it puts the brakes on online attacks. Make sure attackers can’t abuse lockouts to deliberately lock users out.
- Shield remote access: Services such as RDP don’t belong directly on the internet but behind a VPN with MFA.
- Block weak passwords: Check new passwords against lists of commonly used and already leaked passwords.
- Store passwords securely: Web applications should store passwords only using special, deliberately slow hashing methods. This makes offline attacks considerably harder.
- Monitor failed attempts: Unusual spikes in failed logins should trigger an alert.
How Rootsektor can help
In a web application penetration test, we check whether your login functions can withstand automated login attempts – from rate limiting and account lockouts to the implementation of multi-factor authentication. We examine remote access such as VPN and RDP in a network and infrastructure penetration test. You can get a fixed-price quote after scoping via our Pentest Quote page.