Why Botnets Work: Distributed Brute-Force Attacks Need No Synchronization

Abstract

In September 2017, McAffee Labs quarterly report [2] estimated that brute force attacks represent 20% of total network attacks, making them the most prevalent type of attack ex-aequo with browser based vulnerabilities. These attacks have sometimes catastrophic consequences, and understanding their fundamental limits may play an important role in the risk assessment of password-secured systems, and in the design of better security protocols. While some solutions exist to prevent online brute-force attacks that arise from one single IP address, attacks performed by botnets are more challenging. In this paper, we analyze these distributed attacks by using a simplified model. Our aim is to understand the impact of distribution and asynchronization on the overall computational effort necessary to breach a system. Our result is based on Guesswork, a measure of the number of queries (guesses) required of an adversary before a correct sequence, such as a password, is found in an optimal attack. Guesswork is a direct surrogate for time and computational effort of guessing a sequence from a set of sequences with associated likelihoods. We model the lack of synchronization by a worst-case optimization in which the queries made by multiple adversarial agents are received in the worst possible order for the adversary, resulting in a min-max formulation. We show that, even without synchronization, and for sequences of growing length, the asymptotic optimal performance is achievable by using randomized guesses drawn from an appropriate distribution. Therefore, randomization is key for distributed asynchronous attacks. In other words, asynchronous guessers can asymptotically perform brute-force attacks as efficiently as synchronized guessers. I. INTRODUCTIONFrom online banking [3] and bitcoin wallets [4], to secure shell (SSH), file transfer protocol (ftp), and telnet servers [5], and passing by governmental institutions [6], brute-force attacks have shown to be one of the major threats to network security. Despite the computational burden on the attacker, brute-force attacks are prevalent. This can be explained through multiple points of view. First, passwords are often weaker than what they ought to be, meaning that attackers can hope to find the correct password well before they query a significant portion of the possible password strings. Next, attacks through huge networks of compromised computers (botnets) are now more common, giving access to significant computational resources for the attacker. More critically, these botnets help to disguise the attack by distributing it. Indeed, a main solution to the threat of online brute-force attacks is to setup a system that detects and prevents too many queries from any one user, as determined by IP addresses. As such, an attacker which uses only a single IP address would be limited to a fixed number of guesses. In recent years, however, this defense was circumvented by using massive botnets, each bot querying potential passwords. In this situation, it is hard to detect legitimat...

Noisy Guesses

“…x V (x)W (y|x). As is well known from previous work (see, e.g., [5], [6]), randomized guessing according to an i.i.d. distribution Q yields a guessing exponent of ln( y P (y)/[Q(y)] ρ ).…”

Security and Privacy for Green IoT-Based Agriculture: Review, Blockchain Solutions, and Challenges

“…• A brute force attack aims to produce a list of all possible passwords that can be used by IoT devices at agriculture sensors layer, then to exhaust them one by one until the correct password can be identified [65].…”

Some Useful Integral Representations for Information-Theoretic Analyses

“…Given a distribution of X , a commonly used performance metric for this problem is the expected number of guesses or, more generally, the moment of the number of guesses until X is guessed successfully. When it comes to guessing random vectors, say, of length n , minimizing the moments of the number of guesses by different (deterministic or randomized) guessing strategies has several applications and motivations in information theory, such as sequential decoding, guessing passwords, etc., and it is also strongly related to lossless source coding (see, e.g., [ 9 , 10 , 11 , 12 , 13 , 19 , 20 , 21 , 22 , 32 , 33 , 34 ]). In this vector case, the moments of the number of guesses behave as exponential functions of the vector dimension, n , at least asymptotically, as n grows without bound.…”

“…Consider a random guessing strategy where the guesser sequentially submits a sequence of independently drawn random guesses according to a certain probability distribution, , defined on . Randomized guessing strategies have the advantage that they can be used by multiple asynchronous agents, which submit their guesses concurrently (see [ 33 , 34 ]).…”