What is password spraying?

And how to prevent it

Amidst rising global tensions over the recent years, the internet has also become a virtual battlefield. In January this year, one of the world’s most high-profile tech giants revealed a password spray attack against the company. Email accounts of the senior leadership team and employees in legal and other functions were compromised as a result.

In the meantime, a famous cybersecurity firm’s X account was also hijacked in a brute-force password attack. Links to a cryptocurrency drainer phishing page were subsequently sent to followers. These recent events serve as a stark reminder of the ever-looming cyber threats that businesses and individuals face today.

In a digital age where almost everything happens online, how do we avoid falling victim to such cyber intrusions?

“Spraying” passwords?

Let’s rewind a bit. When we first mentioned the password spray attack, you might have been confused by the term “spray”, which probably evoked vivid imagery of hackers showering passwords everywhere indiscriminately.

Well, that’s pretty close.

As its name implies, password spraying involves trying numerous common passwords on a limited set of user accounts, even focusing on one account only. Because hackers aren’t repeatedly trying to log in over a short period of time, they can reduce the risk of being locked out due to excessive numbers of attempts.

Once intruders take down a target, they can then move laterally within a system and tamper with related data and assets, until achieving their goals. The ultimate purpose might be removing account access, spreading malicious content, destroying data and so on.

Let’s say an attacker is targeting an airline. They have a list of accounts owned by employees who can access the customer database. Instead of attempting to guess each employee’s individual password, the attacker tries a common combination (such as “mypassword000”) on each account in the list, until finding one that works. Once in, they proceed to steal and sell customers’ data, from personal information, travel history to credit card numbers.

Not your only concern

The consequences sound quite rough, I know, but password spraying is not the only type of attack to raise your guard against. Other common password hacking tactics include:

• Brute-force attack: Such operations make numerous hit-or-miss attempts to gain unauthorized access to a single account. A hacker can try up to 2.18 trillion password/username combinations in just 22 seconds, so weak passwords can be cracked in no time.

• Credential stuffing: Instead of relying on trial and error to find the right answer, this kind of assault leverages previously stolen credentials. After an account break-in, threat actors will proceed to try the password across various platforms, hoping that it’s recycled and reused.

And there’s more. Click here for a deep dive into 8 common types of password attacks that could jeopardize your personal and business data.

Prevention is better than cure

With so many different attacks running rampant, implementing robust preventative measures is crucial to data protection. This should especially be a priority for small and midsize businesses, which are becoming increasingly attractive prey. In the face of the 35 Alarming Small Business Cybersecurity Statistics for 2024, how can SMBs navigate the tricky landscape of password security?

For businesses:

• Enforce password policies: Implement strong password requirements, including length, complexity, and regular changes.

• Implement 2FA: Require employees to use two-factor authentication (2FA), adding an extra layer of security beyond passwords.

• Go passwordless: Explore passwordless authentication methods, such as biometrics or cryptographic keys.

For employees:

• Check password health regularly: Check password strength on a regular basis and promptly update any weak or compromised ones.

• Generate unique passwords: Create a unique, complex password for each account using password management tools to prevent credential stuffing.

• Sign in with MFA: Whenever possible, enable multi-factor authentication (MFA) for an extra layer of protection against unauthorized access.

• Go passwordless: Adopt passwordless alternatives, such as biometrics or security keys, to reduce reliance on traditional passwords.

Synology C2 has an answer

In an ever more hostile internet environment, Synology’s C2 Password and C2 Identity make an ideal choice for businesses seeking to eliminate password-associated vulnerabilities. Providing all the above mentioned functionalities, both services are tried and proven in helping organizations ensure password security.

For example, C2 Password presents a clear overview of all your login items along with the last scan time and alert status. Just a quick glance at your dashboard reveals any security concerns, allowing you to take immediate measures.

With C2 Identity, businesses can set up password requirements, expiry policies, 2FA deployment and passwordless sign-in. Using these fine-grained settings and controls, you’ll be more equipped than ever to tailor your security practices to align with specific company needs.

Act now

With malicious players acting swiftly and attack surfaces expanded, every second counts in the fight against online threats. Both C2 Password and C2 Identity now offer a free trial for security-minded users like you. Try today to get a head start in the cybersecurity race.