Hackers thrive on exploiting bad user habits. It simplifies their job and opens the door to a rising threat known as Password Spraying. As a small IT company in Abbotsford, BC, specializing in IT services and tech support, we aim to shed light on this cybersecurity issue and how you can safeguard your business.

Unmasking Password Spraying

Password Spraying is a form of brute-force attack employed by cybercriminals. In traditional brute-force attacks, hackers attempt to gain access to a specific account by trying numerous passwords. Some even go a step further by conducting research, scouring users' social media profiles for personal information like family names or pet names—common choices for passwords. It's astonishing how much can be gleaned from a brief online search.

To counter these attacks, many organizations now implement security measures such as locking an account after a certain number of failed login attempts (typically 3 to 5).

However, hackers have adapted. Password spray attacks involve two primary tactics.

Type 1: "Low and Slow"

In this approach, cybercriminals start by compiling a list of usernames to target, which is often straightforward due to the structured email formats used by organizations (e.g., firstinitial.lastname@companyname.com). With a list of employee names, they have a pool of potential login usernames.

Next, they "spray" these usernames with a single common password, like "password" or "123456." Occasionally, they get more cunning by incorporating local references, such as "canucks," for a Vancouver-based company. They continue this process until they find a match.

Hackers particularly favor companies or systems with central administrators or apps that set default passwords for new users. Some users may forget to change their passwords during their first login, creating opportunities for cybercriminals.

Type 2: "Availability and Reuse"

The second type of spray attack relies on compromised login credentials obtained from the dark web. Attackers exploit the widespread habit of using the same passwords across multiple sites.