mask attack

0001-01-01

A mask attack is a targeted form of brute force attacks in which the attacker exploits patterns in known passwords to reduce the number of attempts required to crack a password.

An example of this is as follows:

An attacker knows that their target is using a specific make and model of wifi router. Looking at a few different units of this make and model, the default password is always using the pattern of <adjective><noun><three digits>. The attacker can build a custom word list to match this pattern.

Another example is the same scenario as above, but the passwords are more randomized. After observing a handful of models, the default passwords are always an upper case letter, two digits, three lower case letters, a number, and an uppercase letter. The attacker can create wordlists or use a mask format reflecting this pattern in their password cracking software to only try passwords matching this pattern, reducing the number of attempts required to crack the password.


Links to this note