They use the back door.
Yup, after a few failed attempts at the login page, most services lock either the account or the IP address from which the attempts are being made.
Here’s the thing: that’s not how hackers hack, and it’s certainly not how they perform brute force attacks that try every possible password.
Nope. Instead of knocking politely at the front door, hackers try to barge in the back.
Hackers and brute force
Hackers get locked out of login pages after a few wrong passwords, just like you do. But most hackers don’t guess passwords at your login screen at all. They steal whole databases from other companies, use sneaky software on your computer, or trick you into typing your password on a fake page.
Passwords in rapid succession online
If many different passwords are tried in rapid succession, that account will get locked out.
But hackers aren’t sitting in front of a computer and patiently trying password after password after password.
Help keep it going by becoming a Patron.
Related
9 Ways Your Account Can Be Compromised, Even with a Super-strong Password
Strong passwords are important, but they don't protect you from everything. I'll look at other ways your account can be compromised.#4492
The “slow” brute force attack
Take that definition of “rapid” you mentioned: three sign-in attempts in rapid succession. What does “rapid” mean? Three attempts in one minute? Five minutes? Ten? And is it three attempts? Or ten? Or something else? When do the counters and clocks reset?
If you have a sense for what those numbers are (and they can be determined by a few experimental attacks), then you can throttle your attack to be slower than that.
This means that the attack can take a really, really long time. But hackers don’t care. They automate this and just turn it loose. There’s little additional cost. At some point — in a week or a year or more — and across multiple accounts — the hacker could get lucky when one of the accounts finally falls.
For years, across every server I run or manage online, there’s been a slow but persistent series of failed logins. If you look at the server’s log file in real time, you can see it happening over and over and over again.1 Slow, but persistent. If I had accounts with weak passwords2, they might eventually break in.
The “fast” brute force attack
This is a different kind of attack — the one we usually mean when we talk about needing long, complex passwords that take centuries to crack. In these cases, the hackers aren’t knocking at the front door; they’re breaking in at the back.
Data breaches happen when hackers compromise the security of an online system and steal the entire database of account names and (hopefully encrypted) passwords.
With that database in hand, the hackers are limited only by the computing resources they can apply to the problem as they attempt to crack those encrypted passwords. They can make thousands or millions of attempts per second, or even more.
It’s not uncommon for these types of brute force attacks to succeed against some of the accounts in the database, particularly those with weak, common, or reused passwords.
Even though they can attempt to crack passwords at massive speed, I don’t believe this is the most common approach to account compromise.
Related
Don’t Fall for It: Social Engineering and How Scammers Hack Your Brain
Think you're too smart to fall for a scam? Think again. Scammers aren't targeting your intelligence; they're targeting your humanity. I'll share the sneaky mind tricks they use every day and help you spot the red flags before it's too late.#190031
Malware
Malware — specifically keyloggers — is more likely to lead to account hacks than database breaches, particularly if your passwords are strong and unique.
As I say often, once on your computer, malware can do anything, and that includes capturing your passwords as you enter them3.
Naturally, your best defense is not to allow malware on your computer to begin with. Make sure you’re running up-to-date security software, and, of course, don’t download or open random things that you’re not 100% certain of.
Even so, I don’t think this is the most common way passwords are compromised these days.
Phishing
With all the emphasis on blocking the techniques that compromise accounts and passwords, hackers must resort to the human element: you and me. Social engineering and phishing are probably the most common ways accounts get compromised these days.
No malware, no breaches, no brute force attacks; hackers just trick us into giving them our credentials.
Particularly with the rise of AI, hackers can create exceptionally convincing yet fake login pages that their exceptionally convincing phishing emails direct us to. Made to look like an emergency or urgently required action, we dutifully click the link and sign in to the fake page. The problem is that we didn’t sign in at all; we just handed our sign-in credentials to the hacker via that fake sign-in page.
Do this
While there’s little you can do to prevent large-scale data breaches or even brute-force attacks, there are things you can and should do.
- Long, strong passwords are your single best way to prevent brute-force attacks from hacking your account.
- Unique passwords for every site prevent additional compromise should your password be discovered.
- Two-factor authentication protects your account should that account’s password be compromised.
- Beware social engineering so as to keep from accidentally handing over your credentials to a hacker.
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
Another reason to use a password manager. If one were to click on a link in a phishing email, if a login screen appears, the password manager wouldn’t enter the username and password because the URL wouldn’t match the one stored in the password manager’s pass card. It would be one last chance to pause and reconsider before divulging sensitive information.
I sometimes get 2FA requests (via Outlook on my mobile device) indicating that someone is trying to log into my Microsoft account (and it’s not me.) Sometimes I have to Deny a lot of them, and yet they seem to keep coming. Does Microsoft track this sort of thing and shut down the source? I don’t really want my own account to get locked as a result, but I do want Microsoft to apply scrutiny to someone trying to break in. (My Microsoft password is unique and I don’t use it on any other account.)
It’s disconcerting because I do let Microsoft manage some passwords and access to some financial accounts. I don’t know if it is targeted at me or if there are brute force attacks on Microsoft accounts generally.
The source keeps changing, so there’s no way to lock it out.
This is actually a type of attack. They rely on the victim (you) getting tired of it all or making a mistake and clicking “OK” rather than whatever “It’s not me” would be.
Microsoft has done the right thing by making it virtually impossible to approve the login by accident. You need to enter a code which I don’t have, so my only options are to ignore it or deny it.
The vulnerability would be if it starts with a phone call and they somehow con you into entering a number. That requires an incredible amount gullibility.
The title of this article: “If Too Many Bad Password Attempts Cause Account Locks, How Do Hackers Hack In?” begs an incredibly broad discussion, because black-hatters employ such diverse methods of attack. With that said, I begin by agreeing with @Mark H, that my password manager is one of my most effective defenses against phishing attempts, but I have another that I believe to be as important, and perhaps even more effective because it minimizes my exposure to these attacks in the first place.
I use Thunderbird as my desktop email client (the way I get and interact with incoming email messages), and the first thing I do with every email message I receive is to look at the sender’s information: Full name, email address and subject. If I don’t recognize the sender, I treat the message as spam, and move it to my email account’s spam folder. If I recognize the sender, I may read the message, but I still never click any hyperlinks without first inspecting the destination URL for it’s correlation with it’s label, regardless how innocuous it may seem, and even then, if the link purports to lead me to something I want to investigate further, rather than trusting the safety of the purported destination, I navigate there by other means (via my password manager, an Internet search, etc.). All in all, I suppose that my ever increasingly skeptical attitude regarding everything and everyone coming from the Internet (my reaction to the ever evolving threat landscape) is my best, most effective defense against malware in general, and phishing in particular.
All the above, combined with keeping everything I have installed on my computer as up to date as possible, thanks to Windows update, my Garuda Linux software updater, and UniGetUI for my installed software on Windows, and my 3, 2, 1 backup regimen, I’m about as well protected from the threats we all face today as I can be, and that’s all I can ask.
Ernie