Brute Force Attacks - How They Crack Passwords

About 2 min read

A brute-force attack is an attack method that mechanically tries every possible combination of a password until the correct one is found. "Brute force" means "by sheer power," and it is considered the most primitive yet reliable method for breaking ciphers or cracking passwords. In theory, any password can be cracked given enough computing resources, but the time required increases exponentially with the length and complexity of the password.

Historical Background

Brute-force attacks have existed alongside the history of cryptanalysis. The cracking of the Enigma cipher during World War II also contained elements of brute force in a broad sense. As computer performance improved, the DES cipher (56-bit key) became crackable by brute force in the 1990s, accelerating the migration to the stronger AES. Today, the use of GPUs and cloud computing has dramatically increased attackers' computing power. As of 2024, the latest GPUs can perform billions of hash computations per second, completing the cracking of short passwords in an instant.

The Difference Between Brute-Force Attacks and Dictionary Attacks

A pure brute-force attack tries every combination of characters in order starting from the first character, whereas a dictionary attack is a variant that prioritizes trying a list of commonly used passwords. For simple passwords like "password123" or "qwerty," a dictionary attack is far faster. Password spraying is a method that tries a small number of commonly used passwords against many accounts, with the characteristic that it easily evades account lockout. In real attacks, these methods are used in combination.

Estimated Time Required for an Attack

A 6-character password using only lowercase letters has about 300 million combinations and can be cracked by a modern GPU in a few seconds. A 12-character password including uppercase letters, lowercase letters, digits, and symbols has about 4.75 quintillion combinations and would take thousands of years or more to crack. Extending it to 16 characters produces an astronomical number of combinations, making it effectively impossible to crack. Use entropy as a guide to generate passwords with sufficient strength.

How a Brute-Force Attempt Looks in Authentication Logs

A brute-force attack leaves an unmistakable pattern in authentication logs. Automated attempts run at a rate that hand-typed logins cannot approach, so a burst of failed logins concentrated on the same account or coming from the same source is itself grounds for suspecting a brute-force attempt. Put the other way round, simply counting failures per unit of time is enough to notice an attack in progress. Because the attempts continue until they succeed or are blocked, the point is not to read the logs after an incident to confirm the traces, but to monitor those counts continuously so the attack is noticed while it is still running.

How the Attack Works

Effective Countermeasures

The most effective countermeasure against brute-force attacks is to use a sufficiently long, random password. If you generate a random password of 16 characters or more with passtsuku.com, cracking it would take an astronomical amount of time at current computer performance. On the service side, account lockout (temporarily suspending an account after a set number of failures), rate limiting (limiting the number of attempts), and the introduction of CAPTCHA are effective. Combining it with two-factor authentication prevents unauthorized logins even if the password is cracked.