nerdexam
EC-Council

312-50V9 · Question #562

If a token and 4-digit personal identification number (PIN) are used to access a computer system and the token performs off-line checking for the correct PIN, what type of attack is possible?

The correct answer is B. Brute force. When a token performs offline PIN verification, an attacker who physically obtains the token can attempt every possible PIN combination without network lockout constraints.

System Hacking

Question

If a token and 4-digit personal identification number (PIN) are used to access a computer system and the token performs off-line checking for the correct PIN, what type of attack is possible?

Options

  • ABirthday
  • BBrute force
  • CMan-in-the-middle
  • DSmurf

How the community answered

(29 responses)
  • A
    10% (3)
  • B
    79% (23)
  • C
    3% (1)
  • D
    7% (2)

Why each option

When a token performs offline PIN verification, an attacker who physically obtains the token can attempt every possible PIN combination without network lockout constraints.

ABirthday

A birthday attack targets hash collisions to find two inputs with the same hash output and is not applicable to guessing a numeric PIN.

BBrute forceCorrect

A 4-digit PIN has only 10,000 possible combinations (0000-9999). Because verification is done offline on the token itself, there is no server-side lockout or rate limiting, making an exhaustive brute force attack feasible against the device directly.

CMan-in-the-middle

A man-in-the-middle attack requires intercepting communication between two parties; offline PIN checking means no network communication occurs during verification.

DSmurf

A Smurf attack is a network-layer DDoS technique using ICMP broadcast amplification and has no relevance to token-based authentication.

Concept tested: Offline token PIN brute force vulnerability

Source: https://csrc.nist.gov/publications/detail/sp/800-63b/final

Topics

#token authentication#PIN brute force#offline attack#multi-factor authentication

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice