## 4 Attack Surface Analysis
### Radio Access Control
#### 4.1.2 Formal Model for Attack Scaling  
Attack Scaling Model:  
Let us define the Attack Time \(T\) for a brute-force password attack as a function of the following:  
* Password space size: \(S\);
* Processing rate per node: \(R\) (in attempts/second);
* Number of parallel nodes: \(N\). Then, the attack time \(T\) is given by:  
\[T=\frac{S}{R\cdot N} \tag{2}\]  
For dictionary-based attacks, let \(D\) be the size of the dictionary. Then, the attack time becomes:  
\[T_{\text{dict}}=\frac{D}{R\cdot N} \tag{3}\]  
Example: If a password dictionary has \(5\times 10^{6}\) entries, each node attempts \(5\times 10^{5}\) passwords per second and there are 2 parallel nodes:  
\[T_{\text{dict}}=\frac{5\times 10^{6}}{5\times 10^{5}\cdot 2}=5\;\text{s}\]  
Scalability Insight: As \(N\) increases linearly, \(T\) decreases inversely. This shows that brute-force and dictionary attacks can be significantly accelerated using parallel computing resources, which APTs often possess. Pseudocode: Scalable Dictionary AttackThis pseudocode Listing 1 abstracts the concept of attack scaling using multiprocessing logic. It simulates how APTs can distribute brute-force or dictionary attacks across multiple processing nodes or cloud systems for significantly reduced execution time. ```
defscalable_dictionary_attack(dictionary,password_hash,nodes): partitioned_dicts=split(dictionary,nodes) parallel_results=[] foriinrange(nodes): result=spawn_worker(partitioned_dicts[i],password_hash) parallel_results.append(result) forrinparallel_results: ifr.found: return\"r.password
```  
Transitioning the attack from online to offline improves scalability, particularly with augmented computing capabilities. Although our analysis initially relied on naive brute-force methods to simulate adversarial password attacks, recent developments in password cracking highlight the importance of adopting more advanced models. State-of-the-art tools such as John the Ripper and Hashcat incorporate probabilistic techniques like Markov chains and Probabilistic Context-Free Grammars (PCFGs) to efficiently guess human-chosen passwords. [PERSON]'s foundational work [45] revealed that users tend to select highly predictable passwords, making them susceptible to such probabilistic attacks. More recently, machine learning-based guessers like those presented by [PERSON] et al. [46] and [PERSON] et al. [47] have demonstrated improved efficiency in prioritizing guesses based on empirical distributions from large password leak datasets. Future versions of our attack simulation will incorporate these optimized models to more accurately reflect the capabilities of resourceful APT actors. In our study, we evaluated the performance of both brute-force and dictionary attacks, emphasizing the scalability potential of these approaches. One objective is to scrutinize the security disparities between implementing passphrases and using common word passwords, assessing their relative efficiencies against password attacks. All aspects are elaborated below:  
1. Brute-force Attack: In brute-force attacks, attackers systematically try all possible password combinations until the correct one is discovered. This approach relies heavily on computational power. An experiment was conducted to measure brute-force performance across different computing devices. Table 2 provides a detailed summary of brute-force attack times for passwords of various lengths, ranging from 8 to 16 characters. Each row indicates the password length alongside the corresponding number of possible passwords, calculated as follows. \[Number\ of\ possible\ passwords=n^{62}\] (4) where \(n\) represents the password length. We consider 62 as the number of character types, which includes 26 lowercase letters, 26 uppercase letters, and 10 numbers. Special characters such as (7, \", $, [, ]) are also included in our calculations. Some special characters are allowed, but they are less common.