The Password Attack Designed Not to Trigger Your Lockout

There is a form of credential attack that is easy to describe and difficult to detect, and the reason it is difficult is that it was designed that way.

The pattern looks like this. A single account is targeted. Attempts arrive from a large number of separate addresses, each used once or twice and then abandoned. The attempts are spaced across hours. The campaign pauses for half a day and resumes. Volume in any single hour is trivial. Volume across a week is substantial.

Every element of that shape is a response to a specific control.

One Attempt Per Address

Cloud identity platforms apply rate limiting per source address. An attacker making a hundred attempts from one address is throttled and eventually blocked outright. An attacker making one attempt from a hundred addresses is not, because no individual address does anything unusual.

Distributed infrastructure is inexpensive and disposable. Residential proxy networks, compromised devices and cheap cloud instances all provide addresses that are used once and discarded. There is no meaningful cost to rotation.

Pacing Below The Lockout Threshold

Smart lockout triggers on a number of failures within a window. An attacker who knows roughly where that threshold sits will stay under it, which limits the attempts per account per hour but does not limit the campaign, because time is free.

There is a secondary benefit for the attacker. An account that locks out repeatedly generates complaints, and complaints generate attention. An attack that never locks the account never announces itself to the person who owns it.

Pausing

The most effective element is also the simplest. Sustained activity is easier to notice than intermittent activity, because sustained activity is present whenever anyone looks. A campaign that runs for two hours and stops for ten is invisible to anyone checking a dashboard at the wrong moment, and it produces a plausible appearance of having ended.

Why The Shape Defeats Ordinary Detection

Consider the same activity viewed through two different windows.

Over one day: two attempts from two addresses. That is indistinguishable from a phone with a stale password in the mail client, and most analysts would treat it as exactly that.

Over one week: fifteen attempts from fourteen addresses. One attempt per address is not a device with a stale password. A device reuses its address. Fourteen addresses making one attempt each is rotation, and rotation is deliberate.

Same activity. Same data. The window decides the conclusion.

This is the practical failure mode. A detection that aggregates over an hour or a day will describe a distributed attack as a minor configuration problem, and will do so consistently and confidently.

What To Actually Detect

Volume is the wrong signal. The useful signals are:

• Source cardinality relative to attempt count. Where distinct addresses
• approach total attempts, the ratio itself is the finding.

• Persistence across days. A misconfigured client repeats indefinitely from one
• address. A campaign persists from many.

• The protocol in use. Legacy authentication endpoints cannot present a
• multi-factor challenge, which is precisely why they are chosen.

• Any evidence the password was accepted, whether or not the sign-in completed.
• A challenge satisfied at the password stage and blocked only by a second
• factor means the credential is known to somebody, and that is true regardless
• of whether they got in.

Build the aggregation over a week and grade on the ratio rather than the count. The attack that is designed to look small in every window will still look small, but the ratio will not.

The Uncomfortable Part

This technique works because defensive thresholds are published. Rate limits and lockout behaviour are documented so that administrators can plan around them, and that documentation is available to everyone.

The answer is not to hide the thresholds. It is to stop treating a single threshold as the detection. An attacker optimising against one number will always beat it. An attacker cannot optimise against shape, persistence and ratio simultaneously without abandoning the economics that made the attack worthwhile.