Every day, there are announcements about how easy it is to be hacked and how much of your data may already be in the hands of cybercriminals. Malware, ransomware, data breaches, viruses: we hear these words all the time, and these are the kinds of problems that make IT experts nervous.
One way to gain access to your information is becoming more popular: the brute force attack. What exactly is a brute force attack, and what can you do to stop one?
Brute force attacks
A brute force attack occurs when a hacker attempts to log into your account by trying every possible combination of a password.
Once they find out your username, all they need to do is guess your password to access your information. The hacker tries the first possible password and, when that fails, the next one and so on until they guess the correct password. This is incredibly time-consuming, but there are apps and programs that help hackers by automating the process.
The math behind the attacks
Let’s say you wanted to use a brute force attack to find someone’s ATM personal identification number (PIN). Most PINs are four random digits, each one a number from 0 to 9. That means if a hacker were to try all the combinations (starting with 0000 and ending with 9999), they would have to try ten thousand different PINs.
An email password usually has eight characters, not four, and it also includes letters and numbers. There are 26 lowercase letters, 26 capital letters and 10 numbers, for a total of 62 possible characters for each of the eight characters in a password. That’s over 200 trillion possible combinations, not including special characters (such as !, @ and #) and longer passwords that can add to the complexity.
Before you conclude that a brute force attack could never succeed, you need to realize that a network of hackers working together could crack your password in less than a minute using random generators.
How to protect yourself from brute force attacks
If you want to avoid being the victim of such an attack, there are a few things you can try:
- Create the most complex password possible: there is no guarantee that this will make you completely safe, but it does help. If a password is too complex, hackers may move on to an easier target. A 12 to 16 character password is even more secure. It should be a random mix of lowercase letters, capital letters, numbers and special characters.
- Limit login attempts: the easiest solution is to limit the number of login attempts. If you set the limit to 3, you get three opportunities to enter the correct password: if you make a mistake, you still have two other chances. After the third attempt, the system locks the account until it is verified by email or a time limit is reached. This means that a hacker has only three chances to break in before the alarm goes off and the account is locked.
- Enable two-factor verification: hackers may be able to get your password by brute force, but they must then enter a code sent to your cellphone or generated by a third-party app. To hack your account, they would have to steal your password AND your physical cellphone. Common two-factor authentication apps include Google Authenticator, 1Password (which also doubles as a secure password vault), LastPass Authenticator (only for iOS) and Authy.
Keep your website safe
Brute force attacks have been a problem for a long time, whether you knew it or not. With advances in security such as two-factor verification, it is possible to block these hackers and stay one step ahead of them. Always make the security of your website a top priority, not just for you, but for your visitors and customers as well.