Offline Attack

Definitions

1. An attack carried out against data the attacker already holds, rather than against a live system, so the target cannot see, slow down, or block the attempts. The classic case is password cracking: after stealing a database of password hashes, an attacker guesses candidate passwords locally with tools such as Hashcat or John the Ripper, limited only by their own hardware, which for fast hashes such as MD5 can mean billions of guesses per second on GPUs. Captured Wi-Fi WPA2 handshakes, encrypted archives, and disk images are attacked the same way. In an online attack, by contrast, each guess goes to the real login service, where rate limits, lockouts, and monitoring apply. Defences therefore have to be built into the stored data itself: unique salts defeat precomputed rainbow tables, and deliberately slow, memory-hard password hashes such as bcrypt, scrypt, and Argon2 make each guess expensive. Strong, unique passwords remain the final line of defence.

   In plain English: An attack carried out later on stolen data without needing to keep talking to the victim system.

   Example: "The real damage came after the database dump, when attackers launched an offline attack against the unsalted password hashes."

Related Terms

• Credential Cache
• Credential Leak
• Credential Store
• Credential Theft
• Decryption Key
• Key Length
• Key Recovery
• Key Size
• Keychain