[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 1 · 1.2.b
AP Cybersecurity · Introduction to Security
Exploiting Weak Authentication
Adversaries guess the way people actually build passwords — which is a very short list.
key ideaAdversaries do not guess randomly. They guess the way people actually build passwords.
How the attack works
A brute-force search of every possible password is hopeless. A search of the few thousand passwords a particular person is likely to have chosen is not — and human password habits are regular enough to generate that list from public information.
The expensive part is GATHER, and it happens on public pages rather than against your systems. By the time a login form sees anything, the candidate list is already short and well-ordered.| Common human pattern | Example shape | Why it helps the adversary |
|---|
| word + year + symbol | Summer2024! | a template with only a few thousand fillings |
| family or pet names | Bailey07 | the name is on a public profile |
| significant dates | 0914Anna | birthdays and anniversaries are published |
| capitalize the first letter | Password1 | satisfies complexity rules predictably |
| substitute look-alike characters | P@ssw0rd | cracking tools apply these swaps automatically |
| reuse across sites | — | one breach elsewhere unlocks everything |
Every row is a rule that shrinks the search space. Complexity requirements do not help when everyone satisfies them the same way.
| Attack | Input | Where it runs |
|---|
| dictionary attack | a word list, often personalized | against the live login |
| credential stuffing | username-password pairs from another breach | against the live login |
| password spraying | a few very common passwords, many accounts | against the live login |
| offline cracking | a stolen password database | on the adversary’s own hardware, at full speed |
The first three are noisy and detectable. The last is silent — which is why how a service stores passwords matters as much as how users choose them.
Indicators
what each technique leaves behind
- Bursts of failures with one username and many passwords — a dictionary attack.
- A few failures across many usernames — spraying, hiding under lockout thresholds.
- Successful logins with no failures at all — stuffing with credentials that were already correct.
- Guesses that closely resemble the user’s life — a sign the list was built for that person.
Worked analysis
EX 1
Build the adversary's list
A target posts publicly about her dog Rufus, her wedding in 2019, and her football club. Sketch the dictionary an adversary would assemble.
1
Harvest the nouns
Rufus, the club name, the spouse's name, the city.
2
Harvest the numbers
2019, the wedding date, birth years.
3
Apply the standard template
word + digits + symbol gives Rufus2019!, Rufus19!, Rufus!2019.
4
Apply the standard substitutions
Ruf0s2019! and similar — tools generate these automatically.
5
Count the result
A few thousand candidates, not billions. That is a list a tool exhausts in minutes.
EX 2
Why complexity rules disappoint
A policy requires eight characters, one capital, one digit and one symbol. Explain why this helps less than it appears.
1
Ask what users actually produce
Summer2024! satisfies every clause.
2
Ask how they satisfy each clause
Capital first, digits at the end, symbol last — almost universally.
3
Note what that does to the search
The rules describe a template the attacker can generate directly.
4
Name the real defense
Length and unpredictability — a long passphrase or a generated password.
5
Add the second layer
Multifactor authentication, so a correct guess still is not enough.
Real incident
credential stuffing · consumer streaming platform · multiple waves
Thousands of accounts taken over without a single password being guessed
Attackers replayed username-password pairs leaked from an unrelated breach against a streaming service. Because many users reuse the same password across sites, a meaningful share of pairs worked first try. To the service the logins looked successful and ordinary — almost no failures to alert on.
Why it matters here: Reuse turns any breach anywhere into a breach here. Unique passwords per site and MFA both break the replay; complexity rules alone do not.
Check yourself
Why is a personalized dictionary more dangerous than a generic word list?
Show answer
It is built from facts about that specific target — pets, dates, family names — which is exactly where people draw passwords from. The list is short, so a tool exhausts it quickly.
Give the password pattern the CED calls out, and why it helps an adversary.
Show answer
One or two words, a two-digit number often signifying a year, and a special character at the end. It is a template, so the attacker generates candidates instead of searching blindly.
Why do credential-stuffing attacks produce so few failed logins?
Show answer
The pairs were already correct somewhere else. Where reuse applies, the login succeeds on the first attempt, so failure-rate alerting sees nothing.
Which two defenses actually break these attacks?
Show answer
Long, random, unique passwords — ideally from a password manager — and multifactor authentication, which keeps a correct guess from being sufficient.