[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 4 · 4.2.b
AP Cybersecurity · Securing Devices
How Password Attacks Exploit Vulnerabilities
Online attacks are loud and limited. Offline attacks are silent and unlimited.
key ideaOnline attacks are loud and limited. Offline attacks are silent and unlimited.
How the attack works
If an adversary compromises a legitimate user's password and the organization has not enabled MFA or other protections, they can act within that user’s access — legitimately, as far as the system is concerned. Everything below is a route to that.
The split is about where the work happens. Online, every guess touches your systems and can be slowed or stopped. Offline, the adversary already has what they need and you cannot see them working.| Attack | Online or offline | What it exploits |
|---|
| password spraying | online | a common password tried across many accounts — too few attempts per account to trip a lockout |
| credential stuffing | online | default administrative credentials on services and devices such as switches, routers and IoT |
| guessing common passwords | online | users who set passwords that are easy to guess |
| hashcracking | offline | a captured hash — automated tools hash candidates and compare |
| rainbow table | offline | a precomputed, sorted table of passwords and their hashes |
| password reuse | either | a stolen user database from one organization unlocking accounts at another |
Reuse is the multiplier across the whole table. When one organization’s user database is stolen, every other service where those users reused a password is affected — and none of them will see an attack until it succeeds.
Online password attackAttempts user:password combinations in an active authentication portal. Slow, and visible in the logs.
Offline password attackThe adversary has captured the hash and works on their own hardware — unlimited attempts, no logging on your side.
Password sprayingA common password attempted across many accounts, staying under per-account lockout thresholds.
Credential stuffingTrying default administrative usernames and passwords that ship preconfigured on switches, routers and IoT devices.
Rainbow tableA table of candidate passwords and their hashes, sorted by hash so a captured hash can be looked up rather than recomputed.
Term check. The CED defines credential stuffing as trying common default credentials or stolen account credentials on a service or device, and its examples center on default logins; in industry the term almost always means replaying username:password pairs stolen in one breach against other sites (the password-reuse row above).
Indicators
four facts that shape the defense
- Hashes cannot be reversed — offline tools hash guesses and compare against the capture.
- A rainbow table trades storage for time: precompute once, then look up many hashes fast.
- Salt is what defeats rainbow tables, because the precomputed table no longer matches.
- MFA is the control that survives all of these — a correct password stops being sufficient.
Worked analysis
EX 1
Why offline is worse
An adversary captures a password hash. Compare their position with an online attacker.
1
Count the constraints online
Rate limits, lockouts, and every attempt logged.
2
Count them offline
None — the work happens on the adversary's own hardware.
3
State the speed difference
Online is a handful of guesses per minute; offline is limited only by the hardware.
4
State the visibility difference
You cannot detect an offline attack at all — nothing touches your systems.
5
Draw the conclusion
Protecting the hash matters as much as protecting the password, because its theft removes every defense at once.
EX 2
Spraying versus stuffing
Distinguish password spraying from credential stuffing, and say what each exploits.
1
Describe spraying
One common password attempted across many accounts.
2
Say what it exploits
Users who choose easy-to-guess passwords — and per-account lockouts that never trip.
3
Describe stuffing
Trying default administrative credentials that ship preconfigured on devices and services.
4
Say what it exploits
Switches, routers and IoT devices deployed without changing the defaults.
5
Give the two controls
Ban common passwords and alert organization-wide for spraying; change every default credential at deployment for stuffing.
EX 3
How a rainbow table works
Explain a rainbow table attack, and why salt defeats it.
1
State the construction
A list of common passwords is used to generate a table of each password and its hash.
2
State the ordering
The table is sorted by hash, so a captured hash can be found by lookup.
3
Say what that buys
The expensive hashing is done once, then reused against any number of captured hashes.
4
Apply salt
Each password is hashed with random bits unique to the user, so the precomputed hashes no longer match.
5
State the effect
The adversary must build a new table per user — which removes the entire advantage of precomputation.
Real incident
default credentials · internet-connected cameras · global botnet
Hundreds of thousands of devices joined a botnet without a single password being cracked
Malware scanned the internet for devices responding on management ports and tried a short list of default administrative usernames and passwords shipped by manufacturers. Devices whose owners never changed them were enrolled within minutes. The resulting botnet was used for large-scale denial-of-service attacks.
Why it matters here: This is credential stuffing in its purest form — no guessing, no cracking. Changing default credentials at deployment would have prevented essentially all of it.
Check yourself
How are password attacks classified?
Show answer
As online — attempting user:password combinations in an active authentication portal — or offline, where the adversary has captured the hash and works on their own hardware.
Why is password reuse so damaging?
Show answer
Many users reuse the same password, or variations of it, across all their accounts. When one organization’s user database is stolen, the credentials work at every other service where they were reused.
What is a rainbow table, and what defeats it?
Show answer
A table of candidate passwords and their hashes, sorted by hash so a captured hash can be looked up. Salt defeats it, because per-user random bits mean the precomputed hashes no longer match.
What does an adversary gain from one compromised password?
Show answer
If the organization has not enabled MFA or other authentication protections, they can act within that user’s access — indistinguishable from the legitimate user.