)
)
In spoof comedies and children's films, it’s a common trope that the password the protagonist must enter to open a safe or unlock top-secret data is, literally, the word "password.” We often laugh at this joke, not realizing it reflects reality with uncanny accuracy.
Contents:
As revealed in our “Top 200 Most Common Passwords” study, “password” is — for real — the most popular password across all countries and industries. "123456" ranks as the runner-up, followed by the obviously more secure “123456789.”
Cybercriminals are well aware that millions of people use the same weak passwords for “protecting” their personal and business accounts — and they take advantage of this vulnerability. One of the ways they do it is through password spraying.
What is password spraying?
In basic terms, password spraying is a type of brute force attack in which a cybercriminal picks a few frequently used weak passwords and tries them across multiple accounts within the same domain to gain unauthorized access.
Therefore, password spraying is not a cyberattack targeted at one specific individual. It's a hit-and-try type of breach attempt based on the statistical probability that among the accounts associated with a given domain, some may be protected with the most common weak passwords.
How does password spraying work?
Here’s an example: An attacker takes a few popular passwords, such as "password123" and "guest," and then systematically tests them across, let’s say, 500 email accounts associated with the “example.com” domain.
So, rather than repeatedly attempting to compromise a single account (which could lead either to account lockout or detection), the attacker tries these common passwords across hundreds of email accounts at the same time which allows them to remain under the radar and increases their chances of hitting the jackpot.
As you can imagine, if the attacker manages to get just one credential right, they can gain unauthorized access to sensitive data or use the account for more malicious actions.
Of course, it's possible for the attacker to compromise numerous accounts in a single password spraying attack. The outcome, whether they achieve their goal or not, depends on the password policies and cybersecurity practices adopted by the targeted organization.
Password spraying vs brute force
As we have already mentioned, password spraying is a type of brute-force attack. However, there are several differences between what we generally call a brute force attack and password spraying.
In a brute force attack, the cybercriminal tries every possible combination of characters and symbols until they find the correct password. This method is exhaustive and can take a very long time, especially if the password is complex or lengthy.
Password spraying is less resource-intensive and can be much faster than brute force. This is because it focuses on using a limited number of common passwords rather than testing every conceivable permutation of numbers and letters.
So, a password spraying attack is a bit like a cybercriminal having a few master keys that work on lots of doors, whereas brute force is like them trying out every key in existence to open each one individually.
Password spraying vs credential stuffing
Password spraying and credential stuffing are both techniques that cyberattackers employ to gain unauthorized access to accounts and systems, but they differ in their approach.
Credential stuffing is a more aggressive method in which attackers utilize previously stolen or leaked username and password combinations, taking advantage of users' tendencies to reuse credentials across multiple platforms. So, while password spraying is based on the premise of weak passwords being in use, credential stuffing relies on reusing compromised credentials across different online accounts belonging to a particular individual.
Password spraying vs dictionary attack
Just like credential stuffing, a dictionary attack shares similarities with password spraying in how cybercriminals utilize the two techniques to gain unauthorized access to accounts. The difference between them lies in the content that the cybercriminal tests as potential passwords.
As we have already discussed, in the case of password spraying, the attacker uses common weak passwords to break into an account, application, system, or network. In the case of a dictionary attack, however, a cybercriminal tries their luck by testing, one by one, each of the words that appear in a dictionary. Why? Because, unfortunately, some people use common words as their passwords. No unique symbols, no numbers — just plain words.
Although dictionary attacks typically have a low success rate, especially when targeted at systems with multi-word passwords, they still pose a significant threat to account security and should not be underestimated.
How to detect a password spraying attack
Regardless of whether you do it for your own security or for the entire company, detecting a password spraying attack usually requires some effort. When it's about making sure your own accounts are safe, using the right tools can often do the trick. However, for businesses, it's also about closely watching and understanding patterns of user behavior. Let us explain a bit more.
As a single user, you can use solutions such as a data breach scanner to check whether any of your passwords or email addresses have been stolen or made available on the dark web. Some of the platforms currently available on the market already have built-in real-time data breach monitoring systems that can keep you informed whether your data has been leaked as a result of password spraying or another cyberattack. For your personal safety, this should be enough to detect a threat.
However, if you run a company with many employees, you need to equip yourself with dedicated IT tools such as Intrusion Detection Systems (IDS) that will allow you to, for example, identify unusual login attempts and password change requests, check the rate of failed login attempts for a particular account, and quickly verify the reputation of every IP address.
What you may also need to do is set up additional security measures like rate limiting (restricting the number of login requests a user can perform within a defined time period) and account lockout (temporarily suspending access to a user account after a specified number of failed login attempts). That should help you quickly respond to any suspicious activity.
How to prevent password spraying attacks
If you want to stop someone from getting into your accounts by trying a bunch of common passwords, here's what you should do:
First of all, get rid of weak passwords. The password spraying technique only works if your passwords happen to be common, easy-to-guess ones. So, do yourself a favor and make your passwords strong and unique so that nobody can easily figure them out.
Update your software regularly. Make sure you always install all security patches and updates to strengthen your digital defenses against potential vulnerabilities.
Get a password manager. Never store your passwords in a .txt file on your desktop or written down in your notebook. Get yourself a good password manager so that you can store and manage passwords in an encrypted virtual space to which only you have access.
Use a password generator. Coming up with strong and unique passwords for all your accounts can be quite a challenge, not to mention trying to remember them all. The good news is you don't have to do it at all. You can simply use a reliable password generator, and it'll create strong, top-notch passwords for you.
Start using passkeys. Passkeys are a new type of digital credentials that are considered much safer than passwords. Not only do they allow you to log in to websites and online services without entering a password, but they are also virtually impossible to intercept.
If your goal is to protect your business against password spraying attacks, you should consider implementing the following strategies as well:
Invest in password management. First, it's important to realize that cybersecurity comes at a cost, but that doesn't mean it has to break the bank. Nowadays, there are cost-effective options available from reliable companies that can help safeguard your company's resources without draining your budget.
Enforce a strong password policy. Define and enforce rules that will get your employees to use complex passwords featuring a combination of uppercase and lowercase letters, numbers, and special characters to improve password security.
Educate your employees. Help the members of your company understand the importance of practicing strong password habits and spotting potential phishing threats to lower the risk of security vulnerabilities.
Introduce multi-factor authentication (MFA). Boost your company’s cybersecurity by requiring users to provide a second form of authentication alongside their passwords, adding an extra layer of protection.
Implement IP whitelisting and blacklisting. Protect your company’s network by allowing access only to trusted IP addresses while also keeping out the known malicious ones.
Enroll a passwordless authentication solution. Enhance your organization's cybersecurity by implementing advanced authentication methods like biometrics or secure tokens, which eliminate the reliance on easily compromised passwords, while simultaneously providing a streamlined user experience.
How NordPass can help with password spraying
NordPass is an advanced yet very intuitive tool that you can introduce in your company as effective protection against different cyberattacks, including password spraying. How so?
First of all, NordPass allows users to securely generate, store, manage, and share passwords, passkeys, credit card details, and personal information. This means that anyone in your company can utilize it to keep all business credentials in one secure place protected by the most advanced data encryption algorithms.
Using our password generation feature, your employees can also quickly create strong, unique passwords that are not even remotely close to the common weak ones.
The safe sharing feature, on the other hand, allows you to avoid situations in which employees send business passwords to each other by email or instant messenger — which are, as you can imagine, very unsafe methods for sharing sensitive information.
Of course, with NordPass you can also enable multi-factor authentication in your organization, and easily build and enforce a strong password policy that all employees will have to comply with.
NordPass is capable of so much more than we can describe in just one blog post. So, if you want to learn about its features and the security measures used to protect companies from cyberattacks, please visit our website.