312-50V9 · Question #562
If a token and 4-digit personal identification number (PIN) are used to access a computer system and the token performs off-line checking for the correct PIN, what type of attack is possible?
The correct answer is B. Brute force. When a token performs offline PIN verification, an attacker who physically obtains the token can attempt every possible PIN combination without network lockout constraints.
Question
If a token and 4-digit personal identification number (PIN) are used to access a computer system and the token performs off-line checking for the correct PIN, what type of attack is possible?
Options
- ABirthday
- BBrute force
- CMan-in-the-middle
- DSmurf
How the community answered
(29 responses)- A10% (3)
- B79% (23)
- C3% (1)
- D7% (2)
Why each option
When a token performs offline PIN verification, an attacker who physically obtains the token can attempt every possible PIN combination without network lockout constraints.
A birthday attack targets hash collisions to find two inputs with the same hash output and is not applicable to guessing a numeric PIN.
A 4-digit PIN has only 10,000 possible combinations (0000-9999). Because verification is done offline on the token itself, there is no server-side lockout or rate limiting, making an exhaustive brute force attack feasible against the device directly.
A man-in-the-middle attack requires intercepting communication between two parties; offline PIN checking means no network communication occurs during verification.
A Smurf attack is a network-layer DDoS technique using ICMP broadcast amplification and has no relevance to token-based authentication.
Concept tested: Offline token PIN brute force vulnerability
Source: https://csrc.nist.gov/publications/detail/sp/800-63b/final
Topics
Community Discussion
No community discussion yet for this question.