🔑 What Is Password Spraying? How to Stop Password Spraying Attacks
Tags: password, security, attacks
Published: 2021-07-14 12:58:10

#### 🔍 Password spraying is a common method cybercriminals use to gain unauthorized #access to sensitive information. Here’s how to stop password spraying attacks.

### <br>
Password spraying is a type of brute-force cyberattack where a cybercriminal tries to guess a known user’s password using a list of common, easy-to-guess passwords such as “123456” or “password.” This process is often automated and occurs slowly over time in order to remain undetected.

Password spraying is a common method that cybercriminals use to gain unauthorized access to computer systems. For example, [IBM’s/The Ponemon Institute’s 2020 Cost of a Data Breach Report](https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/) found that 19% of all data breaches were the result of weak or compromised credentials. Verizon’s 2020 Data Breach Report found that over [80% of all hacking-related breaches](https://enterprise.verizon.com/content/verizonenterprise/us/en/index/resources/reports/2020-data-breach-investigations-report.pdf) involved brute-force methods like password spraying.

Below is everything executives need to know about how to protect their organization from password spraying attacks — how password spraying works, the risks associated with it, and how to eliminate the opportunity for an attack altogether.

## How Password Spraying Works

Cybercriminals are able to use password spraying to gain unauthorized access to your systems because people often secure their accounts with obvious passwords (ones that are easy to guess). Here’s how obvious passwords make this possible.

### 1. Cybercriminals Build or Buy a List of Usernames

There are “[over 15 billion credentials](https://www.computerweekly.com/news/252485713/Over-15-billion-credentials-for-sale-on-dark-web) for sale on [the] dark web” right now. So to start a password spraying attack, cybercriminals often start by buying a list of usernames stolen from other organizations.

However, quite often, cybercriminals also build their own list using the patterns that company email addresses follow (for example, lastname.firstname@yourcompany.com) along with a list of people who work at that company (from LinkedIn, for example).

### 2. Cybercriminals Procure a List of Common Passwords

The most common passwords are also easy for malicious actors to find. For example, common password lists are often[ published in reports or studies](https://nordpass.com/most-common-passwords-list/) each year.[ Wikipedia also has a page](https://en.wikipedia.org/wiki/List_of_the_most_common_passwords) that lists the top 10,000 most common passwords.

Cybercriminals can also build a list of common (but less obvious) passwords with a little bit of extra research. For example, if an organization is located in New York, they could try variations of “Yankees” or “Knicks” or something else New York-related that people often love to use as a password.

### 3. Cybercriminals Try Username Password Combinations

Once a bad actor has a list of usernames and passwords (U/P), cybercriminals try them together to find a U/P combination that works. They’ll often do this using an automated system that tries one password with every user and then repeats this process with the next password in order to avoid being blocked by account lockout policies or IP address blockers that restrict login attempts.

## The Risks Associated with Password Spraying Attacks

[Read more...](https://auth0.com/blog/what-is-password-spraying-how-to-stop-password-spraying-attacks/?utm_source=content_synd&utm_medium=sc&utm_campaign=security)