ITPEC IP April 2023 Question 42
IDs and passwords are leaked from the first website, and the users of this website suffer from a password list attack on the second website. In this case, which of the following is the problem concerning the IDs and passwords for the second website?
Explanation
The same IDs and passwords as the first website are set — a password list attack only works on accounts that reuse credentials leaked elsewhere.
In a password list attack (credential stuffing) the attacker takes the ID and password pairs leaked from one site and tries them, usually automatically, on other sites. The attack does not guess or intercept anything: every login attempt uses a pair that is already known to be real. It succeeds on the second site only where a user registered there with exactly the same ID and password as on the leaked site.
Answer (b)
Why not others:
- •(a) — unencrypted communication lets credentials be intercepted on the line; the attack here uses a list leaked from another site, not eavesdropping
- •(c) and (d) — few character types and short length make a password easier to guess by brute force or dictionary attack, but a leaked password is tried as it is, however long or complex it is
Key rule: A strong password protects against guessing, a unique password per site protects against a leak elsewhere; password list attacks defeat the first and only the second stops them.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.