Brute force and MFA

The attack: Brute force

Brute force tries password after password until one works. The smarter variants are dictionary attacks, which use the most common words, password spraying, which tries a few passwords on a great many accounts to avoid triggering lockouts, and credential stuffing, which reuses username and password pairs stolen elsewhere. It works because so many passwords are short, predictable or reused across sites.

The defence: MFA

Multi-factor authentication (MFA) asks for a second proof besides the password: a temporary code, a phone notification, a hardware key or a passkey. That way a guessed or stolen password is no longer enough to get in. FIDO2 keys and passkeys even resist phishing, because they cannot be used on a fake site.

What stops what

• MFA against Brute force: half damage. Even if the password is guessed, the second factor is missing: access stays closed.
• Brute force against IDS: double damage. Each attempt is a regular login on the right page: a slow, distributed attack looks like normal traffic.
• Brute force against Patch: double damage. It exploits no flaw, it uses the login feature as it is: no update makes a weak password strong.
• Exploit against MFA: double damage. The exploit never goes through the login, it skips authentication entirely: the second factor never comes into play.
• Scanning against MFA: double damage. A scan does not try to log into any account, it only looks at what answers: the second factor is irrelevant.

In every other match-up damage is normal.

Combos with Brute force

• Kill chain (Scanning → Exploit or Brute force, +2 damage): first you find out what is exposed, then you attack the weak spot you found.
• Credential theft (Phishing → Brute force, +2 damage): passwords obtained through phishing make login attempts far more effective.

Brute force attack cards (10)

Password spray

#010 · Attack · Brute force · ◆1 · power 2 · Common · Arena 1 (Laboratory)

Tries a few common passwords on many accounts to avoid lockouts.

Dictionary attack

#019 · Attack · Brute force · ◆1 · power 2 · Common · Arena 1 (Laboratory)

Tries the most common passwords one after another. Works more often than you’d think.

Credential stuffing

#011 · Attack · Brute force · ◆3 · power 5 · Rare · Arena 2 (Corporate network)

Reuses usernames and passwords stolen from other sites: it works because people reuse passwords.

Sweeping brute force

#034 · Attack · Brute force · ◆3 · power 4 · Common · Arena 2 (Corporate network)

A solid attack at a medium cost.

Credential dump

#035 · Attack · Brute force · ◆2 · power 3 · Rare · Arena 2 (Corporate network)

Draw a card.

Low and slow

#095 · Attack · Brute force · ◆1 · power 1 · Common · Arena 3 (Data center)

Few attempts, spaced far apart: they stay under the alarm threshold and lockouts never trigger. For 2 turns, enemy defenses lose 1 toughness at the start of their turn.

Exposed API keys

#198 · Attack · Brute force · ◆3 · power 4 · Rare · Arena 5 (Cloud)

A key forgotten in a public repository is worth as much as a password. Avoided with secrets kept in a vault and repository scanning. The opponent discards 1 random card.

Rainbow table

#036 · Attack · Brute force · ◆5 · power 7 · Epic · Arena 6 (Dark web)

A strong attack with no effects.

MFA fatigue

#213 · Attack · Brute force · ◆2 · power 2 · Common · Arena 7 (Cyber range)

Bursts of approval requests until the tired user gives in. Answered with number matching and a limit on requests. Enemy defenses are exposed (+1 damage) for 2 turns.

Pass-the-hash

#218 · Attack · Brute force · ◆5 · power 5 · Epic · Arena 7 (Cyber range)

A password’s fingerprint is enough to move from one machine to another without knowing it. Limited with unique local credentials and administration tiers. The strongest enemy defense loses 2 toughness and enemy defenses are exposed (+1 damage) for 2 turns.

MFA defence cards (9)

OTP code

#049 · Defense · MFA · ◆2 · toughness 4 · Common · Arena 1 (Laboratory)

A second factor with a temporary code: the password alone is no longer enough.

Password manager

#055 · Defense · MFA · ◆1 · toughness 2 · Common · Arena 1 (Laboratory)

Long, unique passwords for every site, without remembering them. A cheap defense.

Hardware key

#050 · Defense · MFA · ◆3 · toughness 6 · Rare · Arena 2 (Corporate network)

A FIDO2 key: resists even credential phishing.

Bastion host

#059 · Defense · MFA · ◆2 · toughness 4 · Common · Arena 2 (Corporate network)

Taunt: must be hit first.

Passkey

#063 · Defense · MFA · ◆4 · toughness 7 · Epic · Arena 2 (Corporate network)

Regenerate: +1 toughness at turn start.

Network access control (NAC)

#177 · Defense · MFA · ◆3 · toughness 4 · Rare · Arena 2 (Corporate network)

Every device must identify itself before getting in: a stranger stays out or ends up in quarantine. Taunt: must be hit first. Shield: −1 to every hit on your core.

Encrypted vault

#105 · Defense · MFA · ◆3 · toughness 5 · Rare · Arena 3 (Data center)

A digital vault: encrypted data that opens only with several factors. Armor: −1 to every hit taken.

Zero-trust fortress

#110 · Defense · MFA · ◆6 · toughness 8 · Epic · Arena 7 (Cyber range)

An architecture where every access must be verified, even from inside the network. Armor: −1 to every hit taken. Shield: −1 to every hit on your core.

FIDO2 key

#216 · Defense · MFA · ◆3 · toughness 5 · Rare · Arena 7 (Cyber range)

The credential is bound to the real site: on a fake one it produces nothing, and phishing loses its purpose. Counterattack: whoever hits it loses 1 integrity.

Related guides

• Brute force and strong passwords: how they work and how to defend
• MFA and passkeys: what they are and how to use them to protect your accounts

The other card groups

• Phishing and Training
• Exploit and Patch
• Malware and EDR
• Scanning and IDS
• DDoS and Firewall
• Support cards
• Terrains
• Traps
• Spells

All cards and the type chart