Log huntUnit 1 · Topic 1.2
Spot the online password attack
Read a sign-in log and spot the online password attack.
New to this? Read the topic first: 1.2 Suspicious Website Logins.
Simulation · [1.2.A.1, 1.2.A.2]
Log hunt: spot the online password attack
This is the sign-in log for one student account. The student uses school Laptop-114 during the school day (08:00 to 16:00) and sometimes a known phone. Tap every line that is a sign of an online password attack, then check. There are 4.
-
Fine. The student’s usual school device, during school hours.
-
Fine. One failure on the usual device at lunchtime, with no burst of retries and normal sign-ins after it, looks like a typo.
-
Fine. A known device at an ordinary time.
-
Red flag. A login attempt at an unusual time from an unknown device: two signs at once.
-
Red flag. One second later, another failure. Many failed attempts in a short time point to an automated tool guessing passwords.
-
Red flag. The pattern continues: one guess per second from the same unknown device.
-
Red flag. A success right after the burst of failures, from the same unknown device: a strong indicator the guessing worked and the adversary got in, which is why multifactor authentication (MFA) matters: a correct password alone would not be enough.
Go to the topic: 1.2 Suspicious Website Logins