'Brute force' attacks against SMBs on the rise

02.08.2006
The number of "brute force" attacks on small and mid-sized companies has risen dramatically in the past few months, according to Houston-based Alert Logic, an on-demand IT network security company that focuses on small and medium-sized businesses (SMBs).

Brute force attacks are those in which an attacker uses various ways to break into a company's private network, trying various methods until a break-in occurs, said Chris Smith, Vice President of Marketing for Alert Logic.

Alert Logic has seen more than a 1,000 percent increase over the past three months in brute force attacks, the company said in a statement. Considerably more dangerous than random e-mail-borne viruses, the increase indicates that criminals are specifically taking advantage of lesser security measures used by most SMBs, the company said.

"Prior to this, what we noticed out there being directed at mid-sized companies was the more broad-based sweeps or scans, which means that there were certain well-known vulnerabilities that were being targeted, but they were being broadly targeted," Smith said. "That means that the bad guys were broadly sweeping a bunch of companies ... for these general vulnerabilities and when they found those vulnerabilities they would find a way in."

Now, however, hackers are targeting their attacks at specific services like File Transfer Protocol (FTP) and are employing the brute force password cracking technique, Smith said.

"So they'll keep pounding on a particular target, trying to get through," he said. "It's more targeted, more concerted, more persistent. Part of the reason we think we're seeing this is that companies have gotten better about adopting patch managing technology and other technologies that keep those these vulnerabilities that used to be targeted ... relatively covered."