English
Menu

Cyber Attacks and Defense in Practice

A web service saw a large number of login attempts from many different IP addresses, each using a different user's ID and password pair, and some succeeded. Many of the pairs tried matched ones leaked from other services. What is this attack called?

  1. APassword spraying (an attack that tries a few commonly used passwords against many IDs in turn)
  2. BCredential stuffing (a password list attack)
  3. CBrute-force attack (an attack that tries every possible combination of characters in turn against one ID)
Show answer and explanation

Answer: B. Credential stuffing (a password list attack)

Credential stuffing is an attack that uses ID and password pairs leaked from other services to try to log in to a different service, and users who reuse the same password across several services are the victims. Because there are few attempts per ID, lockouts based on the number of failures per ID are not very effective, and the source IP addresses are spread out as well. The countermeasures are having users use multi-factor authentication, refusing passwords known to have been leaked and monitoring trends in successful and failed logins and the characteristics of automated access.

  • A. Password spraying tries a few common passwords against many IDs; it does not use leaked pairs as they are.
  • B. Correct. It tries leaked ID and password pairs, counting on password reuse.
  • C. A brute-force attack tries every combination against one ID; it does not use leaked pairs.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. At a cloud email service that uses multi-factor authentication, an employee was lured to a login screen that looked exactly like the real one and entered a password and a one-time password. The attacker used that screen as a relay to the real service, stole the session cookie issued after login and impersonated the employee. Which of the following most appropriately describes this attack and the countermeasures?
  2. Which of the following is the most appropriate idea of privileged access management (PAM) for protecting server administrator accounts?
  3. A developer accidentally committed a configuration file containing an API key for a cloud service to a public Git repository. On noticing, the developer immediately committed a change deleting the file. Which of the following is the most appropriate response after this?
  4. For four incidents at an organization, the time from occurrence to detection and the time from detection to containment were 10 hours and 4 hours for incident 1, 30 hours and 2 hours for incident 2, 2 hours and 6 hours for incident 3, and 6 hours and 4 hours for incident 4. Which of the following is the correct combination of the mean time from occurrence to detection (MTTD) and the mean time from detection to containment (MTTC)?
  5. For ransomware damage, the loss per incident (SLE) is estimated at 40 million yen and the annual number of occurrences (ARO) at 0.5. Control A costs 6 million yen a year and reduces occurrences to 0.2 per year. Control B costs 3 million yen a year and does not change the number of occurrences but speeds up recovery, reducing the loss per incident to 24 million yen. With the annualized loss expectancy ALE = SLE × ARO and ROSI = (reduction in ALE − annual cost of the control) ÷ annual cost of the control, which of the following correctly gives the control with the larger ROSI and its value?

Comparisons in this topic