One common way that online accounts are breached is through password spraying, whereby lists of a small number of common passwords are used to brute force large numbers of accounts. These attacks are successful because for any given large set of users there will likely be some who are using very common passwords, and these attacks can slip under the radar of protective monitoring which only look at each account in isolation.

To understand how much of a problem this is, the NCSC recently conducted a research study which allowed participating organisations to assess how vulnerable they would be to a password spraying attack. The PowerShell script we used to collect data is still available to download for your own use if needed, but since the study is now over we can’t provide support. From the study we found:

  • 75% of the participants’ organisations had accounts with passwords that featured in the top 1,000 passwords
  • 87% had accounts with passwords that featured in the top 10,000

This data suggests that password spraying attacks are likely to have some success against these organisations, and many other organisations across the UK. Whilst account lockout policies may limit attackers to trying (for example) 10 passwords against a single account per day, the account lockout counters usually reset over time. This allows persistent attackers to try more passwords, and they can (and do) end up trying hundreds or even thousands of common passwords.

Because of this, one of the questions the NCSC frequently get asked is how to mitigate password spraying attacks. High password complexity doesn’t guarantee that passwords will be more difficult for attackers to break, but it usually does make them harder for users to remember – thus driving weaker passwords and more password reuse overall. So instead, we often encourage users to disable complexity requirements and adopt other strategies such as three random words. However, this means that the onus is now even more on users to pick ‘good’ passwords (that is, passwords that cannot easily be guessed), and network administrators ostensibly have very limited defence against password spraying attacks.

Fortunately, there are actually a variety of approaches organisations can take to mitigate these attacks, and the number of available options is growing regularly. As a starting point, we recommend making sure that you do some of the following:

  • configure protective monitoring over externally-reachable authentication endpoints to look for password spraying attacks (some ideas are given in the password guidance);
  • deploy alternatives to passwords where possible (examples can be found in our recently published case studies)
  • enforce multi-factor authentication on your externally-reachable authentication endpoints
  • provide pragmatic advice to users on how to choose ‘good’ passwords
  • regularly audit user passwords against common password lists, using free or commercial tools (or the NCSC PowerShell script)

One of the most effective approaches to stopping these attacks is to prevent users from using common passwords in the first place. Over the last few months, we’ve been talking to several developers of software that uses passwords, and asking them to think about how to prevent their users from setting common ones. Some plan to use something like Troy Hunt’s HIBP service to prevent common passwords, or have user-configurable blacklists in their products (or support third party software that does the same).

Many of our customers use Microsoft technologies for user authentication. The good news here is that they’ve announced a variety of mitigations for password spraying attacks. I’d encourage all admins of hybrid or cloud-only Azure AD networks to have a look at these mitigations and employ them where possible.

However, not all authentication services will provide mitigations for password spraying attacks. If you come across such products, please do suggest to their developers that they should include such mitigations, and point them at this blog if you think it would help. Commercial third party products might help you in the interim. And of course, if your products do have these mitigations, turn them on and monitor your logs!

Andy P

EUD Security Research Lead

Source: National Cyber Security Centre

With over 20 years of experience, Serviceteam IT design and deliver sophisticated connectivity, communication, continuity, and cloud services, for organisations that need to stay connected 24/7. We take the time to fully understand your current challenges, and provide a solution that gives you a clear understanding of what you are purchasing and the benefits it will bring you.

To find out how we can help you, call us on 0121 468 0101, use the Contact Us form, or why not drop in and visit us at 49 Frederick Road, Edgbaston, Birmingham, B15 1HN.

We’d love to hear from you!