We are currently having accounts compromised at a substantially high rate. Some

Question

We are currently having accounts compromised at a substantially high rate. Some in the organization believe that our password complexity requirements is enough to thwart brute force attacks.

I wanted to test and demonstrate how certain password complexity requirements can actually reduce the password search space.

Has anyone done this before? What tools should I look into? I specifically would prefer to test it on our Exchange 2010 OWA web page since that is publicly accessible and not rate limited at the moment.

Explanation / Answer

While it is true that password complexity requirements do reduce the possible search space I'm not sure this is exactly what you're looking for.

Maybe you are referring to the habits of some people to go with more predictable choices (like "Password1") when required to have a mix of lowercase, uppercase, numbers, or symbols. While it is true that implementing password complexity does not prevent use of some weak passwords, it does eliminate the worst of the worst (like "password" and "123456"). But you are right that turning on complexity is not a solution to poor passwords by itself.

If you have evidence that someone is brute forcing passwords over OWA then the logs of the attempts and successes should be enough to show that password complexity is not effective enough. I'm not sure your demonstration of this attack in action would do much more to sway their opinion. And if you are unsuccessful it may actually strengthen their belief that nothing is wrong.

If your goal is to highlight general weaknesses in your fellow employees' password choices then I would suggest password cracking/analysis rather than online brute forcing. It should yield many more weaker passwords in a shorter timeframe which should help highlight any widespread password problems.

Related Questions

Navigate

• Browse (All)
• Browse W
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.