Security

How to get the passwords the attackers used in a Brute Force Attack?

DDewarSplunk
New Member

Morning

I have been reading this article

https://www.splunk.com/blog/2017/06/16/detecting-brute-force-attacks-with-splunk.html

I wondered if there was any way of finding out what passwords the attackers used in a Brute Force Attack.
That's not something which is in the Splunk logs but would be interesting to see.

How would I go about gathering this info?
Thanks

D

0 Karma
1 Solution

FrankVl
Ultra Champion

Typically authentication mechanisms never log the passwords that were attempted. Key reason: if a genuine user makes a small typo, he practically gives away his password (especially if you were able to observe multiple different typos over time). In more advanced authentication schemes that use some kind of challenge-response mechanism, the server does not even see the plain password.

I vaguely recall there are some hacks for sshd to make it log passwords (for use on honeypot systems where you know there is only attackers trying to log in for instance), but that is not something for production systems I would say.

What kind of logins are you monitoring (windows, linux, web applications???), perhaps there is someone here who can answer in more detail specific to that platform.

View solution in original post

0 Karma

DDewarSplunk
New Member

Thanks Frank,

That's what I suspected it is near impossible to get.
I was also wondering if the same applies to usernames the attackers used.

Again I suspect they just tried random over and over again in the hope of a match.

Thanks

D

0 Karma

FrankVl
Ultra Champion

username usually is logged also for failed attempts.

0 Karma

FrankVl
Ultra Champion

Typically authentication mechanisms never log the passwords that were attempted. Key reason: if a genuine user makes a small typo, he practically gives away his password (especially if you were able to observe multiple different typos over time). In more advanced authentication schemes that use some kind of challenge-response mechanism, the server does not even see the plain password.

I vaguely recall there are some hacks for sshd to make it log passwords (for use on honeypot systems where you know there is only attackers trying to log in for instance), but that is not something for production systems I would say.

What kind of logins are you monitoring (windows, linux, web applications???), perhaps there is someone here who can answer in more detail specific to that platform.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...