Security Verification and Offensive-Defensive Practice
Blue Team Manual ③ [Anti-Brute Force]: Effectively Countering Diverse Dictionary Attacks
Dictionary attack is a common method of cyberattack. Attackers attempt to crack user passwords and gain system access by constructing and using various dictionary files. In today's complex network environment, with the advancement of technology and frequent information leaks, the methods of dictionary attacks are becoming increasingly diversified. Combining multiple actual cases, this article provides a detailed analysis of various methods of dictionary construction, password brute forcing, and their defense strategies, aiming to help enterprises and security teams effectively cope with these threats.
▌Dictionary Construction and Attack Methods
Basics of Dictionary Construction
Dictionary construction is the foundation of dictionary attacks, usually divided into indirect and direct collection methods. Indirect methods include using social engineering, public information, and leaked data; while direct methods include obtaining username and password elements of target systems through network scanning, information detection, and other means.
Indirect Information Collection
Indirect information collection refers to gathering information that can be used for dictionary construction without directly interacting with the target system. This includes usernames, email addresses, password habits, etc., obtained from social media, publicly leaked databases, corporate registration information, and other channels.
Social Engineering Attacks: Attackers exploit human psychological weaknesses (such as trust, curiosity, greed, etc.) to obtain user information through deceptive means. For example, an attacker might masquerade as customer service personnel to ask target users for password information.
GitHub Leaks: As the world's largest code hosting platform, GitHub hosts a massive amount of open-source code. Some code repositories may contain sensitive information (such as plaintext passwords). Attackers can use specific search syntax to quickly retrieve whether target organizations have sensitive information leaks.
ICP Filing Information: Websites operating within mainland China must undergo ICP filing, and this information is public. Attackers can use this information to further dig up domain names, subsidiary names, etc., of target enterprises, thereby obtaining more valuable information.
Direct Information Collection
Direct information collection is the process of gathering username and password elements during direct interaction with the target system. Common direct information collection methods include network scanning, detecting open ports and services, etc.
Network Scanning and Port Detection: Attackers scan the target network to detect open ports and running services, and attempt to use weak passwords to brute force these services. Common vulnerable services include FTP, Telnet, Web applications, database services, etc.
Social Engineering Databases (Shegongku): These are collections of leaked internet user data gathered through illegal means. Attackers use this data to attempt login on other platforms via "credential stuffing" to obtain more user information.
Common Attack Methods and Case Analysis
In actual attacks, attackers will construct highly targeted dictionary files based on the collected information and attempt to gain system access through password brute forcing. The following are several common attack methods and case analyses.
GitHub Leaks
GitHub leaks are one of the common methods attackers use to collect sensitive information. In one case, an attacker discovered the work email accounts and passwords of employees of a well-known cloud service provider by retrieving public code repositories. This information was further used to log into internal systems, leading to serious security issues.
Email Address Brute Forcing
By collecting email addresses of target users exposed on the internet, attackers can quickly analyze email naming patterns. Combined with common surname and first name dictionaries, they can generate large lists of email usernames. Next, attackers can use these email username lists along with common weak password dictionaries to perform brute-force attacks, attempting to gain login permissions to the target system.
Attackers' Dictionary Construction Strategies
Constructing an efficient dictionary is one of the key steps in dictionary attacks. The following are several common dictionary construction strategies:
Username Construction Strategy
Username Construction Strategy
Email Usernames: Generate usernames by collecting the target's email addresses and using common email naming rules (such as
firstname.lastname@example.com).Mobile Phone Numbers: Use the target's mobile phone number as a username, as many systems allow users to log in with mobile phone numbers.
Common Username Combinations: Generate various combinations based on employee IDs, name pinyin, etc., such as
zhangsan,zhang.san, etc.Default Usernames: Generate dictionaries using default system usernames (such as
admin,root).Social Media Usernames: Collect usernames from social media platforms to generate dictionaries.
Password Construction Strategy
Common Weak Passwords: Such as
123456,password,qwerty, etc.Based on Personal Information: Generate passwords by combining the target's name, birthday, phone number, and other information, such as
Zhangsan123,19870515, etc.Keyboard Pattern Passwords: Generate passwords based on the arrangement of characters on the keyboard, such as
qwerty,asdfgh, etc.Combination Passwords: Combine common passwords with special characters and numbers to generate more complex passwords, such as
Password123!,Admin@2021, etc.Phrase Passwords: Use phrases or common sentences to generate passwords, such as
ILoveYou,LetMeIn, etc.Company-Related Information: Combine company names and department names to generate passwords, such as
Company2023,ITAdmin, etc.Password Variants: Create variations of known passwords, such as adding prefixes, suffixes, or replacing some characters, like
P@ssw0rd,P@ssword123!, etc.
Typical Attack Case
An attacker obtained internal network access by collecting a company's internal WiFi password. After gaining access, they used simple weak passwords for a preliminary attack and successfully obtained management equipment permissions. Afterwards, the attacker obtained domain control through the Zerologon vulnerability, further intruded into the company's OA system, and ultimately stole a large amount of sensitive data.
▌Defense Strategies
To defend against dictionary attacks, enterprises need to implement multi-layered defense strategies by combining technical measures with security awareness education.
Password Policy
Change Initial Password Promptly: If the system provides an initial password, it should be modified immediately to ensure account security.
Complex Password Requirements: Passwords should contain uppercase and lowercase letters, numbers, and special characters, with a minimum length of 8 characters.
Regular Password Changes: It is recommended to change the password every three months to reduce the possibility of the password being guessed and cracked.
Avoid Using Common Passwords: Choose unique and unpredictable password combinations, and avoid using weak passwords that are easy to guess.
Personal Information Protection: Do not use the names of individuals, relatives, or pets as passwords to prevent security risks brought by personal information leakage.
Separate Work and Private Passwords: Avoid using professional terms or occupational characteristics related to work in passwords to reduce the chance of passwords being cracked by professionals.
Use Password Managers: Generate, store, and manage complex passwords to reduce the risk of reusing passwords.
Multi-Factor Authentication and Account Protection
Multi-Factor Authentication (MFA): In addition to passwords, add extra verification steps, such as SMS verification codes or mobile authentication apps.
Limit Login Attempts: Temporarily lock accounts after consecutive failed login attempts to prevent brute force cracking.
Domain Name Privacy Protection: For newly applied domain names, require the domain registrar to enable domain privacy protection to enhance domain security.
Logging and Monitoring: Regularly check login logs to discover and respond to suspicious activities in a timely manner.
Disable Unused Accounts: Close guest and anonymous accounts, and delete system accounts and test accounts that have not been used for a long time.
Privileged Account Management
Account Full Lifecycle Management: Realize full-cycle management of system accounts and application accounts, such as creation, password modification, and deletion, to ensure account security and compliance.
Password Vault: Adopt an independent password vault design to ensure the security of stored account passwords.
Application Business Support: Support the management of embedded application accounts in middleware business systems, eliminating plaintext passwords in configuration files and business systems.
O&M Management: Combine with bastion hosts and log auditing functions to simplify password security management and reduce the risk of password leakage.
Account Discovery: Automatically discover multiple types of privileged account information to ensure complete visibility and security of accounts.
Key Management: Automatically generate, deploy, and rotate SSH keys to ensure the security of login keys.
On-Demand Privileged Access: Establish an on-demand access authorization and audit mechanism based on O&M events to guard against internal threats.
Database Permission Control: Authenticate mainstream relational databases to prevent key data theft and destruction risks.
Internal Network Protection Strategy
In the internal network environment, administrators should pay special attention to password policies in the domain environment to ensure the security of internal network systems.
Disable Unused Accounts: Close unnecessary accounts and delete accounts that have not been used for a long time.
Strong Password Requirements: Passwords should contain uppercase letters, lowercase letters, numbers, and special characters, and be changed regularly.
Prompt Updates and Security Software Installation: Ensure the operating system and all software are updated with patches in a timely manner, and install antivirus software and firewalls.
Multi-Factor Authentication (MFA): Add extra verification steps, such as SMS verification codes or mobile authentication apps.
Encrypted Storage: Ensure all stored passwords undergo strong encryption processing to avoid plaintext storage.
Regularly Monitor Network Activity: Regularly check for suspicious activities in the network to discover and respond to potential attacks in a timely manner.
Log Analysis and Monitoring
Log analysis is a critical step in penetration testing and security auditing. Through effective log analysis, it is possible to identify whether the system is under attack and take appropriate defensive measures.
Key Asset Filtering
When facing a large number of assets, it is impossible to conduct a comprehensive investigation on all assets. Therefore, priority should be given to filtering the following types of assets:
Historically Compromised Assets: Including hosts that have been compromised in past red-blue confrontations, offensive and defensive exercises, or real hacker attacks. These assets may still have security risks, or some vulnerabilities might have been missed during the remediation process.
Vulnerable Assets Exposed to the Internet: These assets are directly exposed via the Internet and use components or applications with frequent high-risk vulnerabilities, such as Weblogic, JBoss, Fastjson, Shiro, Struts2, etc.
Critical Assets: Such as domain controllers, database servers, email servers, etc. The compromise of these assets may lead to the compromise of a large number of hosts or leak of sensitive data, so they should be prioritized for investigation.
Log Analysis and Judgment Process
Through log analysis, it can be determined whether brute-force cracking behavior exists. For example, when an attacker attempts to enter the system through brute force, whether successful or not, relevant information will be recorded in the log. The main event IDs of concern are 4624 (successful login) and 4625 (failed login). For instance, if the number of failed logins is too high, reaching a certain amount and distributed over an unreasonable period of time, brute-force behavior may exist.
Remote Desktop Connection Logs
Attackers may conduct attacks through Remote Desktop Services sessions, and remote desktop connection logs are an important data source for detecting such attacks. Key event IDs in the logs include 1149 (successful user authentication), 21 (successful Remote Desktop Services session login), 24 (Remote Desktop Services session disconnected), etc.
▌Summary of Anti-Brute Force Strategy
To cope with diversified dictionary attacks, the key lies in comprehensively utilizing technical means and security awareness education to construct a multi-layered defense system. Through various measures such as complex password policies, multi-factor authentication, internal network protection, and log analysis and monitoring, enterprises can effectively reduce the risk of suffering dictionary attacks and ensure system and data security.
