Brute Force Attack
An attack that tries many credential combinations systematically until one works.
Definition
A brute force attack is an attempt to gain access by systematically trying many possible credentials, keys or codes until a valid one is found, relying on computation rather than deception.
Pure brute force tries every combination in a keyspace and is usually impractical against a well-chosen password. In practice attackers use smarter variants. A dictionary attack tries known words and common passwords. A credential-stuffing attack replays username and password pairs leaked from other breaches. Password spraying tries a handful of very common passwords across many accounts, specifically to stay under lockout thresholds.
Password spraying is the variant most likely to succeed against an organisation, and the one most likely to be missed. Because it tries only two or three passwords per account, it never triggers per-account lockout, and the pattern is only visible when you look across accounts rather than at any single one.
Note that the term brute force is also a well-known algorithm concept in computer science, meaning an exhaustive-search approach to a problem. That usage is unrelated to security, and the ambiguity is worth knowing when searching for material.
At a glance
- Severity
- High where MFA is absent
- Prevalence
- Constant background activity against internet-facing services
- Primary targets
- VPN gateways, webmail, remote desktop, admin portals, APIs
How it works
- 1
Identify a login endpoint that accepts credentials and is reachable
- 2
Enumerate valid usernames where possible, often from email formats or public sources
- 3
Select a strategy: dictionary, stuffing from breach data, or low-and-slow spraying
- 4
Attempt authentication at a rate designed to avoid lockout and detection
- 5
On success, escalate quickly before the anomalous login is noticed
Warning signs
- Many failed authentications spread thinly across many accounts rather than concentrated on one
- Failed logins from unfamiliar geographies or hosting-provider address ranges
- Authentication attempts against services with no business reason to be internet-facing
- A successful login immediately following a burst of failures for the same account
- MFA prompts appearing for users who did not initiate them
How to defend
- Deploy phishing-resistant MFA, which defeats guessing regardless of password strength
- Detect across accounts, not just per account, since spraying stays under per-account thresholds
- Check credentials against known-breached password lists at the point they are set
- Remove internet exposure from services that do not need it
- Alert on impossible-travel and unusual-source logins rather than relying on lockout alone
Real-world example
An Indonesian government agency sees no lockout alerts because each account received only two failed attempts. Reviewing authentication logs across all accounts reveals a single source trying the same two seasonal passwords against 3,000 usernames. One account with a weak password and no MFA had already succeeded.
How Claro helps
Brute force is only worthwhile when attackers do not have the password. Phishing gives it to them directly, which is why credential theft has largely displaced guessing. Claro measures whether staff would hand over credentials, and phishing-resistant MFA closes the path that both routes depend on.
Frequently asked questions
What is a brute force attack?
An attempt to gain access by systematically trying many possible credentials until one works. It relies on computation and volume rather than deceiving a person, which distinguishes it from phishing.
What is the difference between brute force and password spraying?
Classic brute force concentrates many attempts on one account, which triggers lockout. Password spraying tries only a few very common passwords across many accounts, specifically to stay below lockout thresholds, so it is far harder to detect.
Does account lockout stop brute force attacks?
Only the noisy kind. Lockout defeats concentrated guessing against one account but does nothing against spraying, which is designed to stay under the threshold. You need detection that looks across accounts, and ideally MFA.
Is brute force the same as the algorithm concept?
No. In computer science, brute force describes an exhaustive-search approach to solving a problem, which has nothing to do with attacking credentials. The terms are unrelated despite sharing a name.
Related terms
Credential Stuffing
An automated attack that tries usernames and passwords stolen from one data breach against many other websites, exploiting people who reuse the same password across accounts.
Password Spraying
An attack that tries a small number of common passwords against a large number of accounts, one password at a time, to avoid triggering account lockout policies.
Multi-Factor Authentication (MFA)
A security method that requires two or more independent proofs of identity before granting access to an account or system.
Account Takeover
When an attacker gains unauthorized control of a user's online account, typically through stolen credentials, and uses it for fraud or further attacks.
Reduce your human risk
Claro measures and lowers the risk these terms describe, in English and Bahasa Indonesia.
Request a demo