ITPEC FE Subject A October 2024 Question 31

Logging in with ID/password lists stolen from other websites — credential stuffing bets on users reusing the same login on many sites.

The attacker obtains user ID and password pairs leaked from one service and tries them, usually automatically, on other services. Every user who reuses the pair is taken over, and because each account sees only one or a few attempts, lockout rules rarely trigger.

Answer (b)

Why not others:

• •(a) — fixing one user ID and trying dictionary words and their combinations is a dictionary attack
• •(c) — fixing one common password and trying it against every possible user ID is a reverse brute-force attack
• •(d) — fixing one user ID and trying every character combination as the password is a brute-force attack, made practical by the short maximum password length

Key rule: Name password attacks by what is fixed and what varies: one ID + dictionary words = dictionary attack, one ID + all combinations = brute force, one password + many IDs = reverse brute force, leaked pairs from another site = credential stuffing.

Security · AI-written, may contain errors