Attackers don’t bother brute-forcing long passwords, Microsoft engineer says

guest · Nov 22, 2021

Attackers don’t bother brute-forcing long passwords, Microsoft engineer says
November 22, 2021
https://therecord.media/attackers-dont-bother-brute-forcing-long-passwords-microsoft-engineer-says/

According to data collected by Microsoft’s network of honeypot servers, most brute-force attackers primarily attempt to guess short passwords, with very few attacks targeting credentials that are either long or contain complex characters.

“I analysed the credentials entered from over >25 million brute force attacks against SSH. This is around 30 days of data in Microsoft’s sensor network,” said Ross Bevington, a security researcher at Microsoft.
“77% of attempts used a password between 1 and 7 characters. A password over 10 characters was only seen in 6% of cases,” said Bevington, who works as Head of Deception at Microsoft, a position in which he’s tasked with creating legitimate-looking honeypot systems in order to study attacker trends.
Click to expand...

Bevington says that only 7% of the brute-force attempts he analyzed in the sample data included a special character. In addition, 39% actually had at least one number, and none of the brute-force attempts used passwords that included white space.
Click to expand...

The researcher’s findings suggest that longer passwords that include special characters are most likely safe from the vast majority of brute-force attacks, as long as they haven’t been leaked online and are part of attackers’ brute-forcing dictionaries.
Click to expand...

Log in or Sign up

Attackers don’t bother brute-forcing long passwords, Microsoft engineer says

guest Guest

Log in or Sign up

Attackers don’t bother brute-forcing long passwords, Microsoft engineer says

guest Guest

Useful Searches