Dictionary and Brute Force Attacks
A dictionary password attack is when a list of words is used against the password in order to guess it. These lists of words containing likely passwords can even be downloaded from the Internet.
A brute force attack is the use of all possible combinations of characters in order to attempt to guess the password.
The account lockout security policy can protect a computer system and account from these types of attacks as the number of incorrect password attempts is limited.
Physical Attacks
When a computer is left unattended and unsecured it is possible for another individual to access it and gain access to passwords.
However, even if it is secured physical access to a computer may allow a hardware keylogger to be installed, allowing the third party access to any key inputs, including any user names and accounts typed into the computer.
A keylogger can also be installed through the use of software, it can be attached to an email for example and, when clicked may not appear to function, however, will create a log file of all keystrokes typed on the computer and forwarded to the third party via the network.
A computer can also be targeted through the use of hidden camera in order to record the keystrokes or they may remove the computer or hard drive within it, allowing direct access of the data present, including any passwords and accounts.
Password Cracking
When an attacker is able to gain access to the password file contained on a workstation or server and can then use password cracking tools such as Ophcrack, Brutus, Ophcrack, RainbowCrack in order to identify the password(s) within them.
Network and Wireless Sniffers
Wireless and network sniffing software allows a device that is connected to the network to identify the active devices and to intercept any unencrypted passwords sent over the network.
The network sniffer is able to read the packets of information sent over the network and if those packets include non-encrypted information then they are able to record that information, including any passwords or user logon data.
The use of a secured wifi connection, such as WEP, WPA or WPA2, prevents such interception as the data transferred from the device to the wifi router is encrypted and, whilst it may still be incepted, cannot be read.
Sniffing software is also able to intercept the data sent from a wireless keyboard to the computer which allows all keystrokes to be identified by the attacker. Due to this possibility, many wireless keyboards now include encrypted data transfer to prevent interception.
About Athena Forensics
For information on our digital forensic services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to the conclusion of any computer forensic investigation.
Our digital forensics experts are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 10 years.
Our forensic experts are all security cleared and we offer non-disclosure agreements if required. Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
https://athenaforensics.co.uk/service/mobile-phone-forensic-experts/
https://athenaforensics.co.uk/service/computer-forensic-experts/
