Security

How to get the passwords the attackers used in a Brute Force Attack?

DDewarSplunk
New Member

Morning

I have been reading this article

https://www.splunk.com/blog/2017/06/16/detecting-brute-force-attacks-with-splunk.html

I wondered if there was any way of finding out what passwords the attackers used in a Brute Force Attack.
That's not something which is in the Splunk logs but would be interesting to see.

How would I go about gathering this info?
Thanks

D

0 Karma
1 Solution

FrankVl
Ultra Champion

Typically authentication mechanisms never log the passwords that were attempted. Key reason: if a genuine user makes a small typo, he practically gives away his password (especially if you were able to observe multiple different typos over time). In more advanced authentication schemes that use some kind of challenge-response mechanism, the server does not even see the plain password.

I vaguely recall there are some hacks for sshd to make it log passwords (for use on honeypot systems where you know there is only attackers trying to log in for instance), but that is not something for production systems I would say.

What kind of logins are you monitoring (windows, linux, web applications???), perhaps there is someone here who can answer in more detail specific to that platform.

View solution in original post

0 Karma

DDewarSplunk
New Member

Thanks Frank,

That's what I suspected it is near impossible to get.
I was also wondering if the same applies to usernames the attackers used.

Again I suspect they just tried random over and over again in the hope of a match.

Thanks

D

0 Karma

FrankVl
Ultra Champion

username usually is logged also for failed attempts.

0 Karma

FrankVl
Ultra Champion

Typically authentication mechanisms never log the passwords that were attempted. Key reason: if a genuine user makes a small typo, he practically gives away his password (especially if you were able to observe multiple different typos over time). In more advanced authentication schemes that use some kind of challenge-response mechanism, the server does not even see the plain password.

I vaguely recall there are some hacks for sshd to make it log passwords (for use on honeypot systems where you know there is only attackers trying to log in for instance), but that is not something for production systems I would say.

What kind of logins are you monitoring (windows, linux, web applications???), perhaps there is someone here who can answer in more detail specific to that platform.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...