Signature Detail

LDAP: Brute Force Login Attempt

This protocol anomaly detects multiple authentication failures within a short period of time between a unique pair of hosts. The IDP considers the following errors returned by the server as an indication of authentication failure (RFC-2251#4.1.10) - strongAuthRequired, inappropriateAuthentication, invalidCredentials, insufficientAccessRights. The number of login failures to trigger this attack can be configured in the Sensor Settings Rule base of your Security Policy.

Extended Description

Multiple login failures within a short period could indicate that a brute force password guessing attack is taking place or has taken place.

References

• URL: http://www.cse.ohio-state.edu/cgi-bin/rfc/rfc2251.html
• URL: http://en.wikipedia.org/wiki/Brute_force_attack
• URL: http://www.ietf.org/rfc/rfc2251.txt?number=2251