An attacker obtains a database of username and password pairs leaked from an unrelated shopping
site, then feeds those exact pairs automatically into the university's staff portal, hoping that some
users reused them.
Which attack is this, and which control from Lecture 7 most directly defeats it?

Question

An attacker obtains a database of username and password pairs leaked from an unrelated shopping
      site, then feeds those exact pairs automatically into the university's staff portal, hoping that some
      users reused them. 
       Which attack is this, and which control from Lecture 7 most directly defeats it?

Answer

A replay attack, defeated most directly by adding a nonce to each login request.

Answer

A brute-force attack, defeated most directly by using a longer key size for the portal's TLS certificate.

Answer

Credential stuffing, defeated most directly by multi-factor authentication.

Answer

A dictionary attack, defeated most directly by increasing the minimum password length.

Crowdly

An attacker obtains a database of username and password pairs leaked from an unr...

Want instant access to all verified answers on online.codl.lk?