In the realm of cybersecurity, engineers constantly battle against a barrage of threats aimed at compromising the integrity of digital systems. One such threat that engineers grapple with is the dictionary attack. In this post, we'll dive deep into the technical aspects of dictionary attacks, their methodologies, and the strategies engineers use to defend against them.

What is a Dictionary Attack

A dictionary attack is a type of cyberattack in which an attacker systematically tries to gain unauthorized access to a user's account or system by trying out a vast number of potential passwords. Unlike brute-force attacks that try every possible combination of characters, dictionary attacks focus on trying a list of commonly used passwords, words from dictionaries, or variations thereof.

The process involves using automated software or scripts to iterate through a list of passwords, which can include common words, phrases, names, and terms found in dictionaries, as well as variations like adding numbers or special characters to the end of words. The goal is to match one of these potential passwords to the actual password used by the target user.

Dictionary attacks take advantage of the fact that many users still use weak and easily guessable passwords, often derived from familiar words or personal information. By leveraging a targeted list of potential passwords, attackers can increase their chances of successfully cracking accounts with minimal effort and time.

Anatomy of a Dictionary Attack

At its core, a dictionary attack is a type of password-cracking attack that takes advantage of human nature's tendency to choose simple and common passwords. Unlike brute-force attacks that exhaustively try every possible combination, dictionary attacks focus on a targeted approach. Here's how it typically unfolds:

1. Gathering Password Candidates: Attackers compile a list of potential passwords, often using dictionaries containing common words, phrases, and variations. These lists can also include personal information about the target, like birthdays or pet names.

2. Automated Trial and Error: Using automated scripts or tools, attackers systematically try each password candidate from the list against the target account or system.

3. Success or Failure: If the target's password matches one of the candidates, the attacker gains unauthorized access. If not, they might refine their list and try again.

Real Case Example of Dictionary Attack

Password Protected PDF

Companies often utilize password protection for sensitive PDF documents like salary statements or credit card statements, which they send individually to recipients on a monthly basis. These documents are secured with a specific password format. Often, you'll notice a recurring pattern in these passwords – they tend to be a combination of the company's initials and a date, or they might consist of a date merged with the last four digits of the corresponding credit card number. Surprisingly, this predictable pattern makes it relatively easy for individuals, sometimes even those with malicious intent, to decipher the password, especially if they somehow manage to gain unauthorized access to the protected document.

Here is a short explaination regarding how it work to crack the pass protected PDF: Basically all that you need to have is 4 script:

• Script to get list of all of the dates in ddmmyyyy format since predefined dates that you desired
• Script to get list of all possible 4 digits start from 0000 to 9999
• Script to generate the combinations of all of the dates and 4 digits that you just generate (yes, this will resulted in a higher CPU usage for a temporary time and a large txt that store all of the list, possibly 2-3GB)
• Script that manipulate pdf (ex: pikepdf in python) and try all of the listed combinations to open the PDF.

I have created all of the script in my private github repository, but quite hesistant to make it public and include it here, but all of the script can be done with ChatGPT so, have fun I guess? 😂

The Engineering Challenge

Engineers face the complex task of devising robust mechanisms to defend against dictionary attacks. Here are some key engineering considerations:

• Hashing Algorithms: To protect user passwords, engineers employ strong cryptographic hashing algorithms. These algorithms convert passwords into fixed-length hash values, making it extremely challenging for attackers to reverse-engineer the original password. (This is one the most common modern solution to handle Rainbow Table attack, which is a more advanced and complex form of password hacking rather than brute forcing all of the possible password)

• Salting: Adding an extra layer of defense, engineers use a technique called salting. A unique salt value is added to each password before hashing, ensuring that even if two users have the same password, their hashed values will differ. (As for the example I provided, add a salt to the password protected file that is hard to "predict" can add extra layer of security for a password protected document)

• Password Policies: Engineers play a pivotal role in implementing and enforcing password policies. These policies can require users to create passwords with a mix of character types, minimum length, and no usage of common dictionary words.

• Account Lockouts and Delays: Engineers often incorporate mechanisms that lock out accounts temporarily after a certain number of failed login attempts. Additionally, introducing time delays between login attempts can thwart rapid dictionary attacks.

Conclusion

In the intricate dance between hackers and engineers, the dictionary attack is a formidable move in the attacker's playbook. However, engineers armed with cryptographic expertise and a deep understanding of human behavior continue to innovate and bolster their defenses. By implementing advanced hashing, salting, and smart user authentication strategies, engineers work tirelessly to fortify systems and keep users' digital lives safe from the clutches of these relentless attacks. As for a non engineer, please do not use your birtdate at any sort of form as your password 🙏

You can find me on

Twitter: https://twitter.com/mlven23
GitHub: https://github.com/melvnl
LinkedIn: https://github.com/melvnl

Note: If you have any questions, you can leave a message below by Sign In with your GitHub account 😉