Introduction

Microsoft's exchange team put up an advisory use authentication policies to fight passwords spray attacks recently. The idea is that if trying different passwords the same user five or ten times results in that account being locked out, the idea is just try one or two passwords and just lots and lots of different usernames as well. It's a high value style of attack because you've got a database of dumped passwords that you know somebody with this username had this password on that site.