What is Brute Force and how to protect against brute force attacks?

In the world of cyber security, the simplest methods of attack often remain the most persistent and effective. One such fundamental and ever-present technique is the Brute Force attack, or “brute force” attack. It does not require sophisticated exploits or fine social engineering. Its strength lies in patience, computing power and systematic testing of all possible combinations in the hope of eventually guessing the correct password.

Every service in your company that is password-protected and exposed to the Internet - from your website login panel to your remote desktop to your email - is a potential target for a brute force attack. Successful hacking using this method gives the attacker direct access to your systems and data. In this guide, we’ll explain how Brute Force attacks work, their most common variations and, most importantly, what multi-layered defenses you should implement to effectively protect your organization against them.

Shortcuts

• What is a Brute Force attack and what is the “brute force” method of cracking passwords?
• What services and protocols (web login, RDP, SSH) are the most common targets of brute force attacks?
• What are the differences between simple Brute Force attacks, dictionary attacks and “password spraying”?
• How is a strong password policy (length, complexity, uniqueness) the first line of defense?
• How do mechanisms for blocking accounts after several failed login attempts stop attacks?
• Why is multi-factor authentication (MFA) the most effective protection against Brute Force?
• What role do CAPTCHA and reCAPTCHA mechanisms play in prevention?
• How to monitor system logs to detect attempted power attacks?
• Can firewalls and IPS systems block Brute Force attacks?
• What are the best practices for securing remote access services?
• What tools are used by attackers to carry out power attacks?
• How can nFlo’s system hardening and MFA implementation services help your company build a multi-layered defense against Brute Force attacks?

What is a Brute Force attack and what is the “brute force” method of cracking passwords?

A Brute Force attack, or “brute force” attack, is a method of cracking passwords or cryptographic keys that involves systematically and persistently checking all possible combinations of characters until the correct one is found. It is a forceful approach that does not rely on any finesse or exploitation of gaps in logic, but on pure computing power and time. The attacker, using automated software, tries to log into the system, testing one by one passwords such as “a,” “b,” “c,” …, “aa,” “ab,” “ac” and so on.

This method, although simple in theory, in practice is extremely effective against weak and short passwords. The shorter and less complicated the password (e.g., consisting only of lowercase letters or numbers), the smaller the number of possible combinations, and thus the faster it will be cracked. Modern computers and specialized graphics processing units (GPUs) are capable of testing billions of passwords per second, which means that simple passwords of a few characters can be cracked in seconds or minutes.

Brute Force attacks can be carried out in two ways. The first is an online attack, where the hacker tries to log directly into a running service (e.g., a Web site login panel). It is slower because it is limited by server mechanisms and network latency. The second, much faster, is an offline attack. It occurs when an attacker manages to steal a database of password hashes beforehand (e.g., as a result of another hack). Then he can attempt to crack those hashes on his own powerful hardware, without any restrictions, testing trillions of combinations per second.

📚 Read the complete guide: IAM / Zero Trust: Identity and access management - from the basics to Zero Trust

What services and protocols (web login, RDP, SSH) are the most common targets of brute force attacks?

Brute Force attacks can target virtually any service that requires username and password authentication and is accessible from the public network. However, there are a few targets that are particularly popular with cybercriminals because of their ubiquity and potential value after a successful takeover.

1. web application login: Login panels for websites, CMS systems (like WordPress), e-commerce stores, administrative panels or business applications are the number one target. Attackers use bots that continually try to guess passwords for user and administrator accounts. Successful account takeovers can lead to data theft, financial fraud or taking control of an entire site.

2 Remote access services: This is an extremely valuable target for attackers, as a successful intrusion gives them direct access to a company’s internal network or server desktop. The most commonly attacked protocols include:

• RDP (Remote Desktop Protocol): Used to remotely manage Windows servers and workstations. The publicly accessible RDP port (3389) is constantly scanned and attacked using Brute Force methods.
• SSH (Secure Shell): Used to remotely manage Linux servers and other network devices. Hackers try to guess passwords for user accounts, especially the root account.

3 Other network services: Force attacks are also often directed at other popular services, such as:

• Email servers (POP3, IMAP, SMTP protocols), where the goal is to take control of the mailbox.

• FTP/SFTP servers, in order to access files stored on them.

• Database accounts (e.g., MySQL, PostgreSQL), if exposed to the Internet.

What are the differences between simple Brute Force attacks, dictionary attacks and “password spraying”?

Although the general idea of a brute force attack is always the same - guessing a password - attackers use various specialized techniques to increase their effectiveness and bypass simple defenses. The three most popular variants are simple Brute Force, dictionary attack and “password spraying.”

Simple Brute Force Attack: This is the most basic and “brutal” form. The machine tests all possible combinations of characters of a certain length, starting with the shortest. It is a very time-consuming method, but with enough computing power it guarantees to eventually find every password if there are no additional safeguards. It is effective mainly against very short passwords.

Dictionary Attack: This is a much smarter and faster approach. Instead of testing random combinations, the automaton uses a predefined list of words (dictionary) that includes the most commonly used passwords, popular names, dates, words from the language dictionary, as well as passwords that have been leaked in previous hacks. Such a dictionary can contain millions or billions of the most likely passwords. The dictionary attack is extremely effective because most users create passwords that are easy to remember and predictable.

Password Spraying (“password spraying”): This is a very sneaky technique designed to bypass account lockout mechanisms. In a traditional Brute Force attack, a hacker takes one account (e.g., admin) and tries hundreds of different passwords on it, which quickly leads to locking it out. In a “password spraying” attack, the opposite is true. The attacker takes one very popular password (e.g. “Spring2024” or “Password123!”) and tries to log in with it on hundreds or thousands of different user accounts in a given company. It then takes another popular password and repeats the process. Since there are only one or two login attempts per account at any given time, the lockout mechanisms won’t work, and the chance that one of the employees used just that simple password is unfortunately very high.

Type of AttackMethod of OperationTargetHow do you protect yourself?Simple Brute ForceTesting all possible combinations of characters.Very short, simple slogans.Long and complicated passwords.Dictionary AttackTesting passwords from a predefined list (dictionary).Predictable, popular slogans.Unique, random passwords (not words).Password SprayingTesting one popular password on multiple accounts.Bypassing the account locking mechanism.Strong password policy, ban on popular combinations, MFA.

How is a strong password policy (length, complexity, uniqueness) the first line of defense?

A strong and rigorously enforced password policy is the absolute foundation and the first, most important line of defense against forceful attacks. Its goal is to force users to create passwords that are mathematically difficult or virtually impossible for automated machines to guess in a reasonable amount of time. An effective policy is based on three pillars: length, complexity and uniqueness.

Length is the most important factor. Each additional character in a password increases the number of possible combinations exponentially. A short password of 8 characters, even if complicated, can be cracked by modern computers relatively quickly. Passwords of 12-14 characters are already much more difficult, and passwords having 16 or more characters are now considered very resistant to brute force attacks. Instead of short, complicated passwords, long password phrases (passphrases), consisting of several random words, are much better and easier to remember.

Complexity refers to the requirement to use different types of characters: lowercase letters, uppercase letters, numbers and special characters. It increases the number of possible combinations for a password of a given length, making it even more difficult to attack. Company policy should require the use of at least three of the four character types.

Uniqueness is key to defending against “credential stuffing” attacks. Company policy should prohibit employees from using the same passwords on different systems, and especially from using work passwords on private services. It’s also worth implementing mechanisms that check whether a newly created password is on the list of passwords that have been leaked during known hacks (known as “pwned passwords”). Tools such as password managers help enforce all these rules by generating and securely storing long, complex and unique passwords for each service.

How do mechanisms for blocking accounts after several failed login attempts stop attacks?

The account lockout mechanism is one of the simplest and most effective defensive measures to slow down and ultimately thwart online power attacks. Its operation is very simple: the system monitors the number of consecutive unsuccessful login attempts to a given account and, once a certain threshold is exceeded, temporarily or permanently blocks further attempts.

When an attacker launches a Brute Force attack on an admin account, he tries different passwords one by one. The system is configured so that after, for example, five unsuccessful attempts in one minute, it automatically locks the admin account for a specified period of time, for example, 15 minutes. This means that for the next quarter of an hour, no attempt to log into that account, even with a valid password, will be accepted.

This simple time block completely destroys the profitability of a power attack. The attacker, able to make only 5 attempts every 15 minutes, loses his greatest advantage - speed. Instead of testing millions of passwords per second, his speed drops to a fraction of an attempt per second. Breaking even a relatively simple password would take hundreds or thousands of years under such conditions, making the attack completely impractical.

When configuring an account blocking policy, it is important to find the golden mean. A threshold that is too low (e.g., 3 attempts) and a lockout that is too long (e.g., permanent, to be unlocked by an administrator) can be a nuisance to legitimate users, who often get confused when entering their passwords, and can be used to maliciously lock out accounts (DoS attack). Therefore, a typical secure configuration is a threshold of 5-10 failed attempts and a time lock for 15-30 minutes.

Why is multi-factor authentication (MFA) the most effective protection against Brute Force?

Multi-Factor Authentication (MFA) is now recognized as the absolute most effective and important defense mechanism against brute force attacks and most credential theft-based attacks. Its strength lies in adding an additional, independent layer of verification to the login process, making it impossible to log in with password knowledge alone.

The MFA requires the user to present at least two different components (factoids) to prove his identity. These components come from three categories:

• Something you know (Knowledge Factor): That is, the traditional password or PIN.

• Something you have (Possession Factor): That is, a physical object such as a cell phone with an authentication application (such as Google Authenticator), a dongle (such as YubiKey) or a smart card.

• Something You Are (Inherence Factor): That is, a unique biometric characteristic, such as a fingerprint, facial or retinal scan.

In the context of a Brute Force attack, implementing MFA completely changes the rules of the game. Even if the attacker, after millions of attempts, finally manages to guess the correct password for an employee’s account, the login process will not be successful. The system, after accepting the password, will ask for a second component - for example, a one-time code valid for 30 seconds from an app on the employee’s phone. The attacker, having no physical access to that phone, is unable to go further.

MFA thus renders classic Brute Force attacks aimed at guessing passwords completely useless. It provides a powerful barrier that protects accounts even if passwords are weak or leaked in another intrusion. That’s why implementing and enforcing a policy of mandatory use of MFA for access to all key corporate systems (email, VPN, cloud applications) is the absolute standard today and the best investment in cybersecurity.

What role do CAPTCHA and reCAPTCHA mechanisms play in prevention?

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) mechanisms and their more modern version, reCAPTCHA from Google, play an important, albeit auxiliary, role in protecting against automated attacks, including online Brute Force attacks. Their main purpose is to distinguish between a human and a bot (automaton) and to block or hinder automated scripts.

The traditional CAPTCHA consisted of presenting the user with a simple test that is easy for a human to solve, but difficult for a computer - most often it was to transcribe distorted text from an image. In the context of a login form, this mechanism could be activated after several failed attempts. When the system detects that there are a series of incorrect logins from a single IP address, it displays a CAPTCHA test before the next attempt. Since a Brute Force attack bot usually cannot solve such a test, its operation is effectively blocked.

More modern versions, such as Google’s reCAPTCHA (v2 and v3), work in a more sophisticated and less intrusive way for the user. reCAPTCHA v2 (the “I’m not a robot” version) analyzes a number of signals, such as mouse movements or time spent on a page, to assess whether a user is human. The v3 version runs completely in the background, analyzing user behavior and assigning a “risk score” without requiring any interaction. If the score indicates a high probability of being a bot, the application can take appropriate action - for example, block a login attempt or request additional verification (e.g. via MFA).

While CAPTCHA is an effective tool for slowing down and blocking simple bots, it should not be considered the only protection. More sophisticated bots, using artificial intelligence or so-called “click farms” (where real people solve CAPTCHA tests for money), are able to bypass these protections. CAPTCHA should therefore be used as an additional layer of defense, complementing other key mechanisms such as account blocking and MFA.

How to monitor system logs to detect attempted power attacks?

Systematic monitoring and analysis of system logs is a key component of proactive detection of attempted Brute Force attacks. Logs are a digital record of everything that happens on IT systems and contain valuable information that can identify suspicious activity, often before an attack is successful.

It is crucial to collect and analyze logs from authentication servers, i.e. those that handle the logging process. Logs from operating systems (e.g., Windows Security Event Log, auth.log in Linux), web servers, databases and the applications themselves should be monitored. Pay particular attention to login events, especially the high number of failed login attempts (event ID 4625 in Windows).

Detecting a large number of unsuccessful login attempts to a single user account from many different IP addresses in a short period of time may indicate a password guessing attempt. On the other hand, detecting a large number of unsuccessful login attempts to many different accounts from a single IP address could be a sign of an ongoing “password spraying” attack. Other suspicious patterns include login attempts outside standard business hours or from unusual, exotic geographic locations.

Manually reviewing thousands of logs is inefficient. Therefore, in corporate environments, central log management systems and SIEM (Security Information and Event Management) platforms are used for this purpose. A SIEM system automatically collects and correlates logs from the entire infrastructure. In it, a security analyst can configure dedicated rules and alerts that will provide real-time notification when patterns indicative of a Brute Force attack are detected. For example, an alert can be set to trigger when the number of failed logins from a single IP exceeds 10 in a minute, allowing an immediate response and blocking the attacker’s address.

Can firewalls and IPS systems block Brute Force attacks?

Yes, modern firewalls (especially Next-Generation Firewalls, NGFW) and Intrusion Prevention Systems (IPS) play a very important role in detecting and blocking Brute Force attacks, providing a key layer of defense at the network edge.

Many NGFW/IPS appliances have built-in, predefined signatures that can recognize characteristic patterns of brute force attacks on popular protocols such as SSH, RDP, FTP and email protocols. The system analyzes traffic in real time, and if it detects that a large number of unsuccessful connection or login attempts to a particular service are coming from a single IP address, it automatically classifies that address as hostile and blocks it for a specified period of time at the firewall level. This prevents the attacker from continuing the attack from the same source.

More advanced systems use behavioral analysis and thresholds. An administrator can define a rule, such as “if one IP address generates more than 100 unsuccessful login attempts to the RDP server in 5 minutes, block it for 24 hours.” This gives great flexibility in adjusting protection to the specifics of a given network.

Note, however, that network-level protection has its limitations, especially in the case of distributed Brute Force attacks. In such a scenario, an attacker uses hundreds or thousands of different IP addresses (e.g., from a botnet) to launch an attack, sending only a few login attempts from each. Such a “slow” attack from multiple sources can be difficult to detect for simple rules based on a single IP address. Therefore, protection at the firewall/IPS level must be complemented by defense mechanisms at the application and server level itself, such as account blocking and MFA.

What are the best practices for securing remote access services?

Remote access services such as RDP or SSH are extremely useful, but at the same time they are one of the most common targets of brute force attacks. Securing them improperly is like leaving the door to the server room open. There are several fundamental practices that drastically improve their security.

1. never expose RDP and SSH directly to the Internet. This is the most important rule. If employees need to access internal systems remotely, it should be done only through a secure corporate VPN. The employee must first connect to the VPN (which in itself requires strong authentication), and only from inside the secure tunnel can he access RDP or SSH servers.

2 Change the default ports. Bots scanning the Internet for open services by default look for them on standard ports (3389 for RDP, 22 for SSH). Changing these ports to non-standard ones (e.g., above 1024) is a simple but effective way to “hide” from massive automated scanners. This is a form of security through obscurity, which, while insufficient in itself, significantly reduces “noise” and the number of attempted attacks.

3 Implement strong authentication:

• Enforce a strong password policy for all accounts that can log in remotely.

• Enable multi-factor authentication (MFA). This is absolutely crucial.

• For SSH, ditch the password login in favor of the much more secure cryptographic key-based authentication.

• Disable or rename default accounts, such as “Administrator” in Windows or “root” in Linux, as they are the first target of attacks.

4 Restrict access at the network level: Use firewall rules to allow access to RDP/SSH ports only from specific, trusted IP addresses (e.g., your office IP address or VPN server). Implement mechanisms to block accounts after several failed login attempts.

What tools are used by attackers to carry out power attacks?

Cybercriminals have a vast arsenal of automated and highly effective tools for launching Brute Force attacks. Many of these are freely available, often open-source software, making the barrier to entry for conducting such attacks very low.

One of the most popular and versatile tools is Hydra. It’s a very fast network password cracker that supports dozens of different protocols, including HTTP, FTP, SSH, RDP, SMB, POP3, IMAP, among others, as well as many databases. It allows easy execution of both dictionary attacks (using a list of passwords) and simple brute force attacks on any network service.

For offline password hash cracking (after the database has been stolen), the most commonly used tool is John the Ripper (JTR). It’s extremely powerful and flexible software that can crack hundreds of different types of hashes. JTR can operate in dictionary attack mode, simple brute-force, as well as in a special “single crack” mode, where it tries to guess passwords based on variations of the user’s login itself. Another competing tool with similar capabilities, optimized to take advantage of graphics card (GPU) power, is Hashcat.

In the context of wireless networks, the standard is the Aircrack-ng package, which includes tools for capturing packets from Wi-Fi networks and then launching dictionary attacks to crack WPA/WPA2 passwords. Many of the tools are also part of larger penetration testing frameworks, such as the Metasploit Framework, which includes modules for brute force attacks on various services. The availability and ease of use of these tools means that Brute Force attacks remain a constant and widespread threat.

How can nFlo’s system hardening and MFA implementation services help your company build a multi-layered defense against Brute Force attacks?

At nFlo, we fully understand that effective defense against Brute Force attacks requires a multi-layered approach that combines both hardening system configurations and implementing modern authentication methods. Our services are designed to build your company a comprehensive and robust defense against this persistent threat.

Our support begins with system hardening and configuration auditing services. Our experts perform a detailed analysis of your servers and services exposed to the Internet, identifying vulnerabilities that can be exploited in power attacks. We verify password policies, configuration of account lockout mechanisms, and check whether services such as RDP or SSH are properly secured. Based on the audit, we provide specific recommendations and help implement changes that minimize the attack surface.

The most important element of our defense strategy is the implementation of multi-factor authentication (MFA). We help companies select and implement the right MFA solution to fit their needs and infrastructure - from authentication applications to physical FIDO2 security keys. Our team carries out the entire technical process, integrating MFA with key services such as Office 365 mail access, VPN connections and Windows and Linux logins.

We also understand that technology is not everything. That’s why our services include security policy development consulting and employee training that builds awareness and teaches how to create strong passwords and recognize threats. When you work with nFlo, you get a partner who will help you implement a comprehensive, multi-layered strategy that will effectively thwart Brute Force attacks and realistically improve your organization’s security.

Related Terms

Learn key terms related to this article in our cybersecurity glossary:

• Network Security — Network security is a set of practices, technologies, and strategies aimed at…
• Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
• Firewall — A firewall, also known as a network firewall or security barrier, is a security…
• Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
• CIS (Center for Internet Security) — CIS is an organization dedicated to creating and promoting best practices in…

---

Learn More

Explore related articles in our knowledge base:

• Cyberbullying - What It Is and How to Defend Against It?
• Privileged Access Management (PAM): How to protect orgaznization
• Smart Grid security: How to protect power grids in the digital age?
• What is Deepfake and How to Defend Against It? - Comprehensive Guide
• What is Spear Phishing - How It Works, How to Protect Yourself, and How It Differs from Phishing

---

Explore Our Services

Need cybersecurity support? Check out:

• Security Audits - comprehensive security assessment
• Penetration Testing - identify vulnerabilities in your infrastructure
• SOC as a Service - 24/7 security monitoring