[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 4 · 4.4.d
AP Cybersecurity · Securing Devices
Identifying Password Attacks in Logs
Count users per source and passwords per user — those two numbers name the attack.
key ideaCount users per source and passwords per user. Those two numbers name the attack.
What to look for
Online password attacks can be detected in authentication logs, because every attempt is a real login attempt. Offline attacks cannot be detected at all — the work happens on the adversary's computer, and nothing about it touches your systems.
| Pattern in the log | What it indicates | Why |
|---|
| one user, many wrong passwords | an online password attack | a single account being guessed against |
| many users within seconds, one or unusual IPs | password spraying | a common password tried across the estate |
| default user:password pairs in quick succession, often one IP | credential stuffing | known defaults being tried in order |
| a login from an unexpected location, IP or time | a compromised password | the credential is correct but the context is wrong |
| nothing at all | possibly an offline attack | it happens on the adversary's computer — undetectable |
Row 5 is not a gap in your logging. Offline attacks cannot be detected because they leave no trace on your systems — which is why protecting the hash database matters so much.
four signatures
- One user, many passwords → an online attack against that account.
- Many users, seconds apart → spraying — count across the organization, not per account.
- Default credentials in sequence → stuffing.
- A correct login from the wrong place or time may mean the password is already compromised.
Reading the evidence
One user, many passwordsguessing
Many users, one sourcespraying
Default pairs in orderstuffing
one authentication log, four windowseach window is a different signature
# window A
02:41 FAIL user=r.okoye src=203.0.113.44
02:41 FAIL user=r.okoye src=203.0.113.44
02:41 FAIL user=r.okoye src=203.0.113.44
# window B
09:02 FAIL user=a.diallo src=198.51.100.12
09:02 FAIL user=k.nowak src=198.51.100.12
09:02 FAIL user=s.iqbal src=198.51.100.12
09:03 FAIL user=t.mbeki src=198.51.100.12
# window C
14:20 FAIL user=admin src=192.0.2.77
14:20 FAIL user=root src=192.0.2.77
14:20 FAIL user=cisco src=192.0.2.77
# window D
16:55 OK user=a.diallo src=203.0.113.201 (usual src: 10.0.4.x, usual hours: 08-18)
window Aone user, three wrong passwords, seconds apart — an online password attack on that accountwindow Bfour users within seconds from one IP — password sprayingwindow Cadmin, root, cisco — credential stuffing with default accountswindow Da successful login — but from an unexpected source, outside usual hourswhat is absentany sign of an offline attack — there would be none
Worked analysis
EX 1
Name each window
Classify windows A, B and C from the log above.
1
Window A
One user, several wrong passwords — a single user attempting many wrong passwords is an indicator of an online password attack.
2
Window B
Four users within seconds of each other from one IP — the CED's definition of password spraying.
3
Window C
A series of default user:password combinations in quick succession from one IP — credential stuffing.
4
Note what distinguishes B from C
Spraying targets your usernames; stuffing targets default ones that ship with devices.
5
State the detection consequence
B is invisible to per-account thresholds; count failures across the organization.
EX 2
The successful login that is the problem
Window D shows a successful login. Why might it be the most serious line in the log?
1
Note the result
It succeeded — so no failure threshold fires.
2
Compare with the baseline
An unexpected IP and a time outside the user's usual hours.
3
Apply the CED indicator
An authorized user logging in from a different location or IP than expected, or at a different time than normal can indicate the password is compromised.
4
Note who the adversary appears to be
The legitimate user — every subsequent action looks authorized.
5
Give the response
Contact the user out of band, and if unconfirmed, reset the credential and terminate sessions.
EX 3
Why the log can be clean and wrong
A team reviews six months of authentication logs and finds nothing. Can they conclude no password attack occurred?
1
State what the logs cover
Online attacks — every attempt is a real login attempt and is recorded.
2
State what they cannot cover
Offline password attacks cannot be detected, because the attack takes place on the adversary's computer.
3
Name the precondition for that
A compromised user:password hash database.
4
State the correct conclusion
No evidence of an online attack — and no information either way about an offline one.
5
Give the implication
If the hash database may have been stolen, assume cracking is underway and force a reset regardless of what the logs show.
Check yourself
What indicates an online password attack in an authentication log?
Show answer
A single user attempting many wrong passwords. If a user:password hash database has been compromised, expect attempts across many accounts too.
What is the log signature of password spraying?
Show answer
Many users trying to log in within seconds of each other from one IP address, or from unusual IP addresses.
What indicates credential stuffing?
Show answer
A series of default user:password combinations attempted on a device in quick succession, often from the same IP address.
Why can offline password attacks not be detected?
Show answer
Because the attack takes place on the adversary’s computer. Nothing about it reaches your systems, so there is no log entry to find.