Threat actors constantly change tactics to bypass cybersecurity measures, developing innovative methods to steal user credentials. Hybrid password attacks merge multiple cracking techniques to amplify their effectiveness. These combined approaches exploit the strengths of various methods, accelerating the password-cracking process.
In this post, we'll explore hybrid attacks — what they are and the most common types. We'll also discuss how your organization can defend against them.
The blended approach of hybrid attacks
Threat actors are always looking for better, more successful ways to crack passwords — and hybrid attacks allow them to combine two different hacking techniques into a single attack. By integrating attack methodologies, they can take advantage of the strengths associated with each method, increasing their chances of success.
And hybrid attacks aren't just limited to cracking passwords. Cybercriminals regularly combine technical cyberattacks with other tactics, like social engineering. By approaching the target from multiple angles, hackers create a complex threat situation that is more difficult to defend against.
Common types of password attacks
In a hybrid password attack, hackers typically combine two distinct techniques: brute force and dictionary attacks. By combining the rapid iteration of a brute force attack with a list of the most commonly used passwords, hackers can quickly try numerous credential combinations.
Brute force attack
Think of a brute force attack like a hacker taking a battering ram to your organization's front door, striking it repeatedly until they gain entry. In these persistent, blatant attacks, cybercriminals use software to repeatedly attempt all possible character combinations until they land on the correct decryption key or password. A brute force attack is especially effective in situations where a user's password is shorter or less complex — and attackers use common base terms found in dictionary lists to give themself a head start.
Dictionary attack
Remembering passwords can be a pain, which is why many of us reuse the same password across different sites or rely on simple password creation standards (e.g., start with a capital letter and end with a number) to make it easier. But hackers take advantage of this, using dictionary attacks, to speed up the process of guessing passwords.
In a dictionary attack, the cybercriminal uses a list of likely password possibilities — including frequently used passwords (Password123), common phrases (iloveyou), or keyboard walks (ASDFG) to boost their odds.
Mask attack
One specific type of brute force attack is a mask attack, where the hacker knows an organization's password construction requirements and can target its guesses to passwords that fulfill those requirements. For example, the hacker may know that an organization requires user passwords to start with a capital letter, contain eight characters, and end with a number, allowing them to set up their attack parameters better. The reality is that if a hacker has any sort of information about a password's makeup, their hybrid attack can happen that much more quickly.
Defending against hybrid password attacks
Hybrid password attacks work so well because they use multiple techniques to simultaneously target weaknesses in a business' password policy. To create a strong defense against hybrid attacks, your organization must develop strategies designed to eliminate weak or compromised passwords and then create stronger password policies that will help you stay secure in the future. Hackers are taking a multi-layered approach to their attacks, and your organization should similarly layer its security defenses. Specific strategies include:
Implement multi-factor authentication (MFA)
One of the best ways to slow down (or prevent) a hack is multi-factor authentication, which requires users to authenticate themselves with more than just a password. With MFA, you may be able to stop a hacker from gaining access even if they successfully crack the password. While no strategy (including MFA) can guarantee 100% security, implementing MFA is an important step in your password security strategy.
Require longer passwords
Hackers love easy targets — and the longer the password is, the longer it takes for hackers to perform brute force attacks. The reality is that at a certain length, it becomes computationally inconvenient for hackers to successfully perform brute force attacks. Recommend users create 20-character or more passphrases — for example, by combining three random words like "shoes-doorknob-caterpillar." Doing so can effectively mitigate the risk of a brute-force attack.
Prevent weak passwords and password patterns
As we discussed, many hackers count on passwords containing commonly used words or patterns to make their hacking faster and easier. So, it stands to reason that if you can prevent users from using those words or patterns, you'll be taking strides to keep your organization safe.
Audit for compromised passwords
Keeping users from creating weak passwords via a strong password policy is a great strategy, but one that can be overcome if passwords are compromised during a phishing attack or breach. That's why it's so important also to take advantage of tools that can scan your Active Directory for compromised passwords.
For example, Specops Password Auditor is a free, read-only tool that identifies compromised Active Directory passwords. By scanning your users' passwords against an ever-updating list of more than 1 billion unique password combinations, you can quickly ascertain which accounts are at risk and take immediate action to secure them. Download for free here.
A stronger password policy to defend against hybrid threats
Hybrid threats take advantage of multiple attack methods — and defending against them requires a multi-layered approach. Consider using a tool like Specops Password Policy to strengthen your password policy requirements, continuously scan for and block over 4 billion known compromised passwords and will guide users toward creating strong passwords or passphrases.
Implementing a Specops password policy can significantly bolster your defense against hybrid security attacks. Here's why:
Layered Defense: Hybrid attacks often combine multiple tactics, like phishing and brute force. A robust password policy adds an extra layer of defense, making it harder for attackers to succeed even if they've gained some initial access.
Length: Encourage the use of longer passwords even in the form of passphrases. This makes passwords much harder to crack, even with sophisticated brute force tools often used in hybrid attacks.
Breached Password Protection: You can scan and prevent the use of passwords that have been exposed in previous data breaches and malware attacks. This is crucial because attackers often use credential-stuffing techniques with leaked passwords in hybrid attacks.
Compliance: Many industries have regulations that require strong password policies. Using Specops Password Policy you can help ensure you're compliant, potentially saving you from fines and reputational damage.
The stronger your users' passwords are, the less likely they are to fall victim to hybrid attacks. With Specops' tools, you can take a hybrid approach to security, ensuring your data and systems stay secure.
Ready to boost your security against hybrid threats? Sign up for your free trial of Specops Password Policy today.
