Microsoft Warns Against Password Spraying

Microsoft Warns Against Password Spraying

As time has passed, cybersecurity attacks have become another way some organizations and nations engage in warfare. You can argue that there is a war going on at all times in cyberspace while hackers—many of which are sponsored by government agencies—try to outdo security researchers at all turns. One such scenario sees customers in the United States and Israeli defense technology sectors becoming the target of “password spraying.”

What Is Password Spraying?

Password spraying is a somewhat disgusting-sounding term used to describe the process of hacking into multiple accounts by spamming commonly used passwords. You can see how this can become problematic, especially considering users’ propensity for using variations of these commonly used passwords.

In the above scenario, Microsoft warns that about 250 Microsoft Office 365 customers in the aforementioned sectors were being targeted by these password spraying tactics. Microsoft has called the group performing such attacks DEV-0343, with the DEV moniker being used to showcase that the attackers are, at this time of writing, not state-sponsored. DEV-0343 is thought to originate from Iran.

Less than 20 of the targets were actually compromised, but it’s shocking that such high-profile targets would opt for such basic passwords, to say the least. It’s reported that organizations using multi-factor authentication are at much less risk compared to those who don’t. According to Microsoft, security professionals should be on the lookout for suspicious connections from Tor networks: “DEV-0343 conducts extensive password sprays emulating a Firefox browser and using IPs hosted on a Tor proxy network.

They are most active between Sunday and Thursday between 7:30 AM and 8:30 PM Iran Time (04:00:00 and 17:00:00 UTC) with significant drop-offs in activity before 7:30 AM and after 8:30 PM Iran Time. They typically target dozens to hundreds of accounts within an organization, depending on the size, and enumerate each account from dozens to thousands of times. On average, between 150 and 1,000+ unique Tor proxy IP addresses are used in attacks against each organization.”

Protect Your Florida Business

In general, your Florida organization should be prepared to analyze its traffic for suspicious activity of any kind, particularly during off-times when nobody should be accessing your infrastructure. Furthermore, it’s critical to remember that passwords are, of course, only one part of an adequate information security strategy and that you should always strive to use multi-factor authentication when possible. Passwords are one part of this process and should be used alongside something else you have, like a secondary device or smartphone, or biometric technology.

You can count on COMPANYNAME to stay in the loop regarding any security risk to your business and implement solutions designed to protect your organization from any potential threats. To learn more about what we can do for your business, reach out to us at PHONENUMBER.

Interested in our Services?

You should be able to run your business without having to worry about managed it support or the security of your data.

Read more about our services and how we can help you.

Related Posts

Schedule Your Free Consultation

"*" indicates required fields

Services you are interested in?*
Yes, subscribe me to Newsletter
This field is for validation purposes and should be left unchanged.

Schedule Your
Free Consultation

Are you exposed to cybersecurity, or technology obsolescence risks? Are their ways to reduce your ongoing Managed IT Support costs or improve business operations?

Information Security by your Managed IT Services provider