{"id":2525,"date":"2018-03-27T22:00:56","date_gmt":"2018-03-27T15:00:56","guid":{"rendered":"https:\/\/humanit.asia\/?p=2525"},"modified":"2019-07-22T14:54:49","modified_gmt":"2019-07-22T07:54:49","slug":"ta18-086a","status":"publish","type":"post","link":"https:\/\/old.humanit.asia\/th\/ta18-086a\/","title":{"rendered":"TA18-086A: Brute Force Attacks Conducted by Cyber Actors"},"content":{"rendered":"
\n

Original release date: March 27, 2018<\/p>\n

Systems Affected<\/h3>\n

Networked systems<\/p>\n

Overview<\/h3>\n

According to information derived from FBI investigations, malicious cyber actors are increasingly using a style of brute force attack known as password spraying against organizations in the United States and abroad.<\/p>\n

On February 2018, the Department of Justice in the Southern District of New York, indicted nine Iranian nationals who were associated with the Mabna Institute for computer intrusion offenses related to activity described in this report. The techniques and activity described herein, while characteristic of Mabna actors, are not limited solely to use by this group.<\/p>\n

The Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) are releasing this Alert to provide further information on this activity.<\/p>\n

Description<\/h3>\n

In a traditional brute-force attack, a malicious actor attempts to gain unauthorized access to a single account by guessing the password. This can quickly result in a targeted account getting locked-out, as commonly used account-lockout policies allow 3-to-5 bad attempts during a set period of time. During a password-spray attack (also known as the \u201clow-and-slow\u201d method), the malicious actor attempts a single password against many accounts before moving on to attempt a second password, and so on. This technique allows the actor to remain undetected by avoiding rapid or frequent account lockouts.<\/p>\n

Password spray campaigns typically target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols.  An actor may target this specific protocol because federated authentication can help mask malicious traffic.  Additionally, by targeting SSO applications, malicious actors hope to maximize access to intellectual property during a successful compromise.<\/p>\n

Email applications are also a target.  In those instances, malicious actors would have the ability to utilize inbox synchronization to (1) obtain unauthorized access to the organization’s email directly from the cloud, (2) subsequently download user mail to locally stored email files, (3) identify the entire company\u2019s email address list, and\/or (4) surreptitiously implements inbox rules for the forwarding of sent and received messages.<\/p>\n

Technical Details<\/h3>\n

Traditional tactics, techniques, and procedures (TTP\u2019s) for conducting the password-spray attacks are as follows:<\/p>\n