Dictionary Attack

 Dictionary Attack

Cryptography attacks:
In cryptography attacks, using tools to eavesdrop such as Tcpdump and Wireshark or per- form port scanning Nmap, Unicornscan, Hping, and so on are considered passive attacks because the attacker isn’t affecting the algorithm (key), message, or any parts of the encryp- tion system. Active attacks attempt to determine the secret key used to encrypt plaintext.
When sensitive information is transmitted outside of trusted systems, it should be encrypted to preserve confidentiality. Few consumers would want their credit card information transmitted through the Internet as plain text. Even when data is stored on an organization's own devices, it is sometimes encrypted to prevent information theft. Several high-profile laptop thefts have raised awareness about the dangers of storing large quantities of personally identifying information on mobile devices. Even when encryption is used, threats to confidentiality still exist. ecause they release their source code to the public, suggestions can be made, and users have the freedom to modify or add to the programming code.

 dictionary attack:
A dictionary attack is a method of breaking into a password-protected computer or server by systematically entering every word in a dictionary as a password. A dictionary attack can also be used in an attempt to find the key necessary to decrypt an encrypted message or document.

In cryptanalysis and computer security, a dictionary attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by trying hundreds or sometimes millions of likely possibilities, such as words in a dictionary.
This attack has many variants, all of which involve compiling a ‘dictionary’. In simplest method of this attack, attacker builds a dictionary of ciphertexts and corresponding plaintexts that he has learnt over a period of time. In future, when an attacker gets the ciphertext, he refers the dictionary to find the corresponding plaintext.
In a dictionary attack, after attackers have access to a password file, they can run a password- cracking program that uses a dictionary of known words or passwords as an input file. Most of these input files are available on the Internet and can be downloaded free. Remember that un- authorized password-cracking is illegal in most parts of the world, including the United States.

Two countermeasures against dictionary attacks include:

• Delayed Response: A slightly delayed response from the server prevents a hacker or spammer from checking multiple passwords within a short period of time.

• Account Locking: Locking an account after several unsuccessful attempts (for example, automatic locking after three or five unsuccessful attempts) prevents a hacker or spammer from checking multiple passwords to log in.

• Dictionary attacks are not effective against systems that make use of multiple-word passwords, and also fail against systems that use random permutations of lowercase and uppercase letters combined with numerals.

You can watch this video to have more information about Dictionary Attack:
https://www.youtube.com/watch?v=9B4e0p6zbwk

RESOURCES:
http://searchsecurity.techtarget.com/feature/Information-theft-and-cryptographic-attacks
http://www.tutorialspoint.com/cryptography/attacks_on_cryptosystems.htm 
https://www.techopedia.com/definition/1774/dictionary-attack
http://www.tutorialspoint.com/cryptography/attacks_on_cryptosystems.htm
Hands On Ethical Hacking book