Security

How to get the passwords the attackers used in a Brute Force Attack?

DDewarSplunk
New Member

Morning

I have been reading this article

https://www.splunk.com/blog/2017/06/16/detecting-brute-force-attacks-with-splunk.html

I wondered if there was any way of finding out what passwords the attackers used in a Brute Force Attack.
That's not something which is in the Splunk logs but would be interesting to see.

How would I go about gathering this info?
Thanks

D

0 Karma
1 Solution

FrankVl
Ultra Champion

Typically authentication mechanisms never log the passwords that were attempted. Key reason: if a genuine user makes a small typo, he practically gives away his password (especially if you were able to observe multiple different typos over time). In more advanced authentication schemes that use some kind of challenge-response mechanism, the server does not even see the plain password.

I vaguely recall there are some hacks for sshd to make it log passwords (for use on honeypot systems where you know there is only attackers trying to log in for instance), but that is not something for production systems I would say.

What kind of logins are you monitoring (windows, linux, web applications???), perhaps there is someone here who can answer in more detail specific to that platform.

View solution in original post

0 Karma

DDewarSplunk
New Member

Thanks Frank,

That's what I suspected it is near impossible to get.
I was also wondering if the same applies to usernames the attackers used.

Again I suspect they just tried random over and over again in the hope of a match.

Thanks

D

0 Karma

FrankVl
Ultra Champion

username usually is logged also for failed attempts.

0 Karma

FrankVl
Ultra Champion

Typically authentication mechanisms never log the passwords that were attempted. Key reason: if a genuine user makes a small typo, he practically gives away his password (especially if you were able to observe multiple different typos over time). In more advanced authentication schemes that use some kind of challenge-response mechanism, the server does not even see the plain password.

I vaguely recall there are some hacks for sshd to make it log passwords (for use on honeypot systems where you know there is only attackers trying to log in for instance), but that is not something for production systems I would say.

What kind of logins are you monitoring (windows, linux, web applications???), perhaps there is someone here who can answer in more detail specific to that platform.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...