Password spray attacks against Microsoft Exchange users are on the rise, the company has warned, urging organizations to set up Authentication Policies as a mitigation measure.
In a Tech Community blog post (opens in new tab) discussing the issue, “the Exchange Team” said many of its customers that leverage basic authentication are being targeted.
“The evidence I see every day clearly indicates that password (opens in new tab) spray attacks are becoming more frequent,” the blog said. As a result, the team decided to turn off basic auth in Exchange Online.
Numbers game
A password spray attack is essentially a brute force assault in which threat actors use automation to try as many username/password combinations on the login screen, until they find one working combination. Unlike basic brute force attacks, though, password spray attacks constantly keep changing usernames, as well as source IPs, too. That prevents any security tools from locking the targeted accounts down.
“It’s a numbers game essentially, and computers are quite good at numbers. And as attacks go, it works,” the blog added.
The protocols most commonly under attack are SMTP and IMAP, the researchers said, adding that POP, while being third on the list, is a far cry from the top two.
To make sure only known accounts can use basic auth with specific protocols, the Exchange Team suggests organizations set up Authentication Policies. “Start with SMTP and IMAP and do it today!,” they say.
Brute force attacks are quite popular among threat actors, mostly because people are known to use the same username/password combination across a wide range of online services.
By compromising one service, and stealing its login data, threat actors can often compromise accounts on multiple platforms, obtaining a real treasure trove of data that enables them to engage in identity (opens in new tab) theft, and in some case, even financial theft.
