Password Attacks by Ramesha Geethan https://padlet.com/rameshageethan/Bookmarks Made with a quick smile en-us 2022-05-26 15:51:45 UTC 2025-11-09 19:07:56 UTC hello@padlet.com Shoulder Surfing rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201053304 Shoulder surfing is a social engineering method that involves peeking over someone's shoulder to observe what they are doing. As a shoulder surfer (with malicious purpose), it's pretty easy to stand next to someone as they fill out a form, use an ATM, or pay with a credit card in a crowded environment.

What Can Be Used For Long-Distance Shoulder Surfing?

Shoulder surfing may also be done from a distance using binoculars or other vision-enhancing gear.

Example for Shoulder Surfing

·       When a coworker sits next to an employee while they converse on the phone about confidential business, a coworker can listen to the employee's call and take notes. 
·       Furthermore, if a person uses a public Wi-Fi network without utilizing a VPN, hackers can intercept important information.

How to Mitigate

o   Install a privacy filter
o   Maintain the awareness of your surrounding
o   Use a password manager
o   Protect pins
o   Avoid using public networks

]]> 2022-05-26 15:54:27 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201053304 Dumpster Diving rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201055964 Dumpster diving is something that looks like taking treasure from someone's trash. In the IT world, dumpster diving is a technique used to retrieve information that could be used to carry out an attack or gain unauthorized access to a computer network from disposed of items.

A dumpster does not have limitations. It goes through access code passwords written down in sticky notes, and sensitive information such as phone call list, meeting minutes or calendar events and can be used by attackers using social media techniques to gain access to the network.

Disposed computer storage devices are can be a gem mine for attackers because information can be recovered from them, including those that have been improperly formatted or erased.  This will include trusted certificates and sensitive passwords. The equipment related to the TPM (Trust Platform Module) data or other hardware IDs that are trusted by an organization is included.

How to Mitigate

o, Ensure all identical information and data are removed from computer equipment before being disposed of or resold.
o   Use a matching secure storage media deletion method
o   Maintain a data retention policy and keep sensitive data clean.
o   Educate the employee about the risk while disposed organizational equipment
o   Using locked trash and trusted recycle bins

]]> 2022-05-26 15:56:40 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201055964 Dictionary Attack rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201059919

A dictionary attack is a method of breaking a network or a password protected computer by using words in a dictionary as a password. It can be used when asymmetric cryptography (encrypt/ decrypt) is done. This risk was created because personal users and businesses use ordinary words as passwords. These attacks usually fail due to the password policy being much updated.

                           
How to Mitigate

o   Allow only three password attempts
o   Require a period of 5 – 15 minutes to re-attempt
o   Use meaningless letters, numbers and symbols
o   Use multi-factor authentication in user account

]]> 2022-05-26 15:59:46 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201059919 Dictionary Attack rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201062646 A dictionary attack is a method of breaking a network or a password protected computer by using words in a dictionary as a password. It can be used when asymmetric cryptography (encrypt/ decrypt) is done. This risk was created because personal users and businesses use ordinary words as passwords. These attacks usually fail due to the password policy being much updated.
                         
How to Mitigate

o   Allow only three password attempts
o   Require a period of 5 – 15 minutes to re-attempt
o   Use meaningless letters, numbers and symbols
o   Use multi-factor authentication in user account

]]> 2022-05-26 16:02:00 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201062646 Brute Forcing Attack rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201079327 A brute force attack is a type of trial-and-error tuning technique. It has been guessed every possibility to encryption keys from rainbow pages or find hidden web pages. In the brute force, the attack uses excessive forceful attempts and tries to force it is way into the private accounts. This is a very old attack method but it is very popular with hackers because it is very complicated and takes passwords from one second to many years very quickly.

How to Mitigate

o   Use encrypting and hashing algorithms
o   Enable two-factor authentication
o   Limiting failing login attempts
o   Implementing CAPTCHAS
o   Increase password complexity
o   Implement proactive threat hunting methods
o   Implement IT hygiene setup and updated security policies

]]> 2022-05-26 16:15:53 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201079327 Rule-Based Attack rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201080137 The rule-based attack is one of the more difficult attack styles. The rule-based approach is similar to a computer language developed to generate password candidates. It has so many functions to extend, cut and modify words and has conditional operators to skip some, etc. That makes it the most accurate, flexible and efficient attack.

]]> 2022-05-26 16:16:32 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201080137 Wire Sniffing rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201082398 The system and network administrators monitor and troubleshoot network traffic using sniffers. Attackers use sniffers to capture data packets containing sensitive information such as user accounts etc. Sniffers can be software or hardware installed in a system. There are two types of sniffing. There are,

o Active Sniffing   - A switch is a p2p device
o Passive Sniffing  - Attackers use MAC address to read

How to Mitigate

o Avoid unsecured networks
o Encrypt messages with a VPN
o Network Scanning and Monitoring

]]> 2022-05-26 16:18:32 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201082398 MITM rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201084247 Man in The Middle is the most common interception attack. When two computers communicate with each other, but actually with another computer in the middle of communication. 

An attack's purpose is to steal personal information such as user names, passwords, other account information, and credit card numbers. Users of banking apps, SaaS enterprises, e-commerce websites, etc...

How to Mitigate

o   Avoid open network Wi-Fi connection
o   Immediately log out from an application when it is not in use
o   Not using public networks
o   Paying attention to browser notification 
o   Use multifactor authentication
o   Use end-to-end encryption algorithms for applications
o   Using virtual private network
o   Secure browsing plugins

]]> 2022-05-26 16:20:02 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201084247 Replay Attacks rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201086663 A replay attack is a type of network attack in which an attacker discovers and fraudulently delays or repeats a data transmission. 

In other words, a replay attack is an assault on the security protocol that uses replays of data transmission from a different sender onto the intended receiving system, misleading the participants into believing the data communication was successful.


How to Mitigate

o   Use advanced digital cryptography
o   Using one-time password
o   Use third party authentication
 


]]> 2022-05-26 16:22:04 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201086663 Rainbow Table Attack rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201088933 A rainbow table attack is a method of hacking in which the perpetrator attempts to crack passwords stored in a database system using a rainbow hash table. A rainbow table is a hash algorithm used in cryptography to store essential data in a database, such as passwords.

 How to Mitigate

o   Use strong password related to password policy (numbers, letters – uppercase and lower case, symbols)
o   Enable two-factor authentication

]]> 2022-05-26 16:23:44 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201088933 Distributed Network Attack rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201090000 Distributed Network Attack is a new method to recover password-protected files. When we are looking after before so many years there is limited the processing power of the user matching. DNA uses the power across the network to decrypt passwords. DNA server installed in a central location of the network. Then DNA server client can access the network.

How to Mitigate

o   Get to know about network traffic of the using network
o   Create a DOS response plan
o   Scale up your bandwidth
o   Move to the cloud

]]> 2022-05-26 16:24:33 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201090000 Credential Stuffing rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201092375 The automatic insertion of stolen username and password pairs ("credentials") into website login forms in order to illegally obtain access to user accounts is known as credential stuffing. Because many users reuse the same password and username/email, entering those stolen credentials to dozens or hundreds of other sites can allow an attacker to breach those accounts as well.

How to Mitigate

o   Use a unique password for each service
o   Use a web application Firewall
o   Limit authentication requests and send notification
o   Use multi-factor authentication

]]> 2022-05-26 16:26:35 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201092375 Key Loggers rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201094065 A key logger is a tool that can record and report on a user of a computer. Key loggers keep track of you by recording what you type as you type it and malicious hackers often install key loggers for nefarious purposes.

How to Mitigate

o   Use Firewall
o   Install a password manager
o   Update the system
o   Consider other additional security tools
o   Change your password

]]> 2022-05-26 16:27:29 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201094065 Phishing rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201094810 Phishing is the practice of delivering fake messages that appear to come from a trusted source. It is often done by email. The aim is to steal sensitive information such as credit card and account information or to install malware on the victim's PC. Phishing is a popular form of cyber threat that everyone should be aware of in order to be protected.

How to Mitigate

o   Do not click on unknown links
o   Do not give information to unsecured websites
o   Rotate password regularly
o   Do not ignore security patch updates
o   Install firewalls
o   Do not be tempted by pop-up messages

]]> 2022-05-26 16:28:01 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201094810 Interception attacks rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201095904 An interception occurs when an unauthorized person has access to secret or private information. Interception attacks are assaults on the network that aim to compromise the CIA Triad's secrecy.

How to Mitigate

o   Use authorization and authentication mechanisms
o   Use Firewalls
o   Use Digital Signatures

]]> 2022-05-26 16:28:54 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201095904 Password spraying rameshageethan https://padlet.com/rameshageethan/Bookmarks/wish/2201096870 Password spraying is an attack that uses a few regularly used passwords to gain access to a large number of accounts. Traditional brute-force attacks try to guess a password in order to obtain unauthorized access to a single account. This can provided useful in the targeted account being locked out, as most account-lockout rules only allow for a certain number of failed attempts within a given time period. Password spray campaigns typically target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols. Targeting federated authentication can help mask malicious traffic.

How to Mitigate

o   Enable multi-factor Authentication
o   Enforce the  use of strong passwords
o   Review passport management programs
o   Create security awareness in workplace

]]> 2022-05-26 16:29:45 UTC https://padlet.com/rameshageethan/Bookmarks/wish/2201096870