What is a dictionary attack?

Definition of a dictionary attack

A dictionary attack is a method used by threat actors to gain unauthorized access to a system or account by entering every word from an already existing list of possible passwords in a systematic manner.

Unlike brute-force attacks that try every possible combination of characters, dictionary attacks work by assuming that many users choose weak passwords that are easily found in common dictionaries or lists of previously breached passwords.

This method of password attack is often automated, accelerated with the help of high-end computing power, and can be highly effective against accounts with weak passwords.

How does a dictionary attack work?

A dictionary attack works by systematically inputting every word from a premade list of potential passwords, known as a dictionary, into a system or application's password field. This list usually includes commonly used passwords, words from the dictionary, phrases, and other minor variations.

The attack begins by entering these words one after the other by utilizing a combination of heavy computing power and automated software or a script that rapidly tests each entry against the password field. This process continues until a correct password match is found or the entire list has been exhausted.

Unlike brute-force attacks that systematically try all possible combination of characters, dictionary attacks are found to be more successful as they exploit the likelihood that many users choose weak passwords, which are easily found in such lists.

An overview on how online and offline dictionary attacks work

Online dictionary attacks

To understand online dictionary attacks, imagine the below mentioned scenario.

You’re trying to unlock a safe with a combination lock that has a large number of possible combinations. You stand in front of the safe and try each combination one by one, entering them manually to see if they work. Each attempt is made in realtime, and if you try too many combinations too quickly, the safe might lock you out or alert someone that there's suspicious activity. This is what happens in an online dictionary attack.

Online dictionary attacks involve an attacker attempting to gain access to a system by systematically entering every word in a predefined list of likely passwords (called a dictionary) into a login interface. These attacks are conducted in real-time against a live target, such as a web login form or an authentication server. In an online dictionary attack, the attacker interacts directly with the target system. Preventive measures such as account lockouts or CAPTCHA challenges to limit the number of login attempts makeonline dictionary attacks less effective.

Offline dictionary attacks

To understand offline dictionary attacks, imagine the below mentioned scenario.

You’ve stolen a list of combinations that open the safe. Instead of trying each combination at the actual safe, you take the list to a secure room where you have access to a duplicate of the safe’s lock mechanism. In this controlled environment, you can try each combination as many times as you want, much faster and without any immediate consequences or restrictions. This is what happens in an offline dictionary attack.

Offline dictionary attacks occur when an attacker gains access to a list of hashed passwords (usually from a leaked database file found on dark web forums) and attempts to crack them by hashing words from the dictionary and comparing them to the stolen hashes.The attacker uses pre-calculated data, such as a leaked database of hashed passwords, and does not interact with the target system during the attack.Theseattacks can be highly efficient, leveraging high-end processing power and software to test many potential passwords quickly.Because there is no real-time interaction with the target system, these attacks are much harder to detect.

Dictionary attack vs. brute-force attack

Dictionary attack vs. rainbow table attack

How to prevent a dictionary attack

• Using complex passwords: Avoid using simple passwords that can be guessed easily. Opt for longer passwords with a mix of letters (uppercase and lowercase), numbers, and special characters.
• Implementation of strong password policies: Implement strong password policies across your organization or systems. This includes setting minimum length requirements, mandating the usage of alphanumeric characters, and periodically updating passwords.
• Multi-factor authentication (MFA): Enable MFA wherever possible. This adds an additional layer of protection by requiring a second form of verification in addition to the regular password.
• Implementing a lockout system: Implement a system that automatically locks user accounts after a series of unsuccessful login attempts. This measure helps thwart attackers from repeatedly guessing passwords.
• Monitoring and alerting: Monitor all login attempts and create alerts for suspicious activities, such as multiple failed login attempts within a short time span, which may indicate a potential dictionary attack happening the background.

Thwart dictionary attacks with ADSelfServicePlus

ManageEngine ADSelfService Plus offers adaptive MFA with 20 different authentication factors, helping you keep dictionary attacks at bay. MFA can be deployed to enhance security across a variety of applications and systems, whether on-premises or in the cloud. Additionally, the Password Policy Enforcer allows administrators to set standards that enforce rules regarding special characters, length limits, character repetition, and patterns. You can even upload a password dictionary and block users from choosing a password that is present in the dictionary. This promotes a more resilient line of defense. And the best part? The breached password protection feature prevents your users from choosing weak or previously compromised passwords.

People also ask