Account lockout attack

Revision as of 11:31, 29 May 2009 by Deleted user (Talk | contribs)

Jump to: navigation, search

aids facts africa [ longines conquest automatic ] [ motorhome travel in australia ] [ coverderm south africa ] page [ eurasian steppes ] [ symantec norton antivirus 2005 full ] [ youthanasia lyrics ] [ unfair dismissal laws in australia ] [ automotive axles ] [ african book hunting ] [ ca etrust antivirus 2005 ] [ asian test scores ] symantic antivirus download [ african tribal music history ] [ building code of australia bca ] [ win 64 antivirus ] [ african american books for children ] [ young asian shaved ] [ mechanics auto ] sitemap [ estate duty south africa ] [ 64bit antivirus software ] [ african chimera violet ] [ automotive steering systems ] [ south africa airlines ] [ death euthanasia pro ] [ jobs western australia government ] [ african location tribe tribe ] [ antivirus software for download ] [ american auto sales ] [ jlg boom lift+australia ] [ ezantivirus reviews ] asianpictures [ african american church family ] [ australian plants society nsw ] webmap [ seeasians passwords ] [ northon antivirus ] emmigrating australia [ anastasias closet ] [ building automation systems compatible with johnson controls ] [ ] [ norton antivirus 2005 does not support the repair feature ] [ asia ship west ] [ automobile sound effects ] [ hawaiian gardens auto repair ] [ asian pacific islander legal outreach san francisco ] [ ancient greece and asia minor ]

This is an Attack. To view all attacks, please see the Attack Category page.

Last revision (mm/dd/yy): 05/29/2009


In an account lockout attack, the attacker attempts to lock out all user accounts, typically by failing login more times than the threshold defined by the authentication system. For example, if users are locked out of their accounts after three failed login attempts, an attacker can lock out their account for them simply by failing login three times. This attack can result in a large scale denial of service attack if all user accounts are locked out, especially if the amount of work required to reset the accounts is signficant.

Risk Factors



eBay attack

Account lockout attacks are used to exploit authentication systems that are susceptible to denial of service. A famous example of this type of attack is eBay's. eBay used to display the user id of the highest bidder (in the meantime they changed their way of working). In the final minutes of the auction, one of the bidders could try to log in as the highest bidder three times. After three incorrect log in attempts, eBay password throttling would kick in and lock out the highest bidder's account for some time. An attacker could then make their own bid and their victim would not have a chance to place a counter bid because they would be locked out. Thus an attacker could win the auction.

Related Threat Agents

Related Attacks

Related Vulnerabilities


Related Controls