Overview
Impossible travel flags logins from locations too far apart in too little time to be the same person. This lesson covers the concept.
Learning objectives
- Explain the impossible-travel concept.
- Describe its use and limitations.
- Connect it to account-compromise detection.
Core concept
Impossible travel is a detection concept: if the same account logs in from two geographically distant locations within a time span too short to physically travel between them, one of the logins is likely not the legitimate user — suggesting the account is being used from two places (possible compromise). For example, a login from one country and, minutes later, a login from a distant country — the user can't be in both. It uses geolocation of login source IPs and timing. Impossible travel is a useful compromise indicator but has real limitations: VPNs, proxies, and mobile networks can make legitimate logins appear from distant or shifting locations, causing false positives. So it's a signal weighed with context and confidence, not a definitive verdict.
How it works
The detection geolocates the source IP of each login for an account and checks the distance and time between consecutive logins: if traveling between the two locations in the elapsed time is physically impossible, it flags "impossible travel" — implying the account was accessed from two places, one likely an attacker. This is a valuable indicator of account compromise (the real user in one place, an attacker elsewhere). But its limitations matter: a VPN or corporate proxy can make a user appear to log in from a far-away location; mobile networks and cloud services can shift apparent geolocation; and IP geolocation itself is imprecise. These cause false positives, so an impossible-travel alert is a lead requiring context — is the user known to use a VPN? does other evidence (unusual device, failed logins, anomalous activity) corroborate compromise? The analyst weighs the alert with confidence, corroborating before concluding compromise. Used judiciously, impossible travel catches a compromise pattern that simpler checks miss.
Practical example
An impossible-travel alert fires: user X logged in from one region and, 20 minutes later, from a region thousands of kilometers away — physically impossible to travel between. The analyst investigates with context: is X known to use a VPN (which could explain it benignly)? Here, X has no VPN usage, and the second login also shows an unusual device and accessed sensitive data — corroborating compromise. Verdict: likely account takeover, prompting response. In a contrasting case, a similar alert turns out to be a user connecting through a corporate VPN endpoint in another country — a benign false positive. The concept flagged both; context and confidence separated real compromise from benign VPN use.
Cybersecurity relevance
Impossible travel is a valuable account-compromise indicator: geographically-impossible consecutive logins suggest an account used from two places (real user + attacker), catching a pattern simpler checks miss. But it's limited by VPNs, proxies, mobile/cloud networks, and imprecise IP geolocation, which cause false positives — so it's a lead weighed with context and confidence (echoing IOC analysis), corroborated by other signals (unusual device, failed logins, anomalous activity) before concluding compromise. It uses geolocation concepts from earlier paths. Understanding both its value and limits is key to using it well — a common, useful, but nuanced authentication detection in the SOC's account-compromise monitoring.
Common mistakes
- Treating an impossible-travel alert as definitive without accounting for VPNs/proxies.
- Not corroborating with other compromise signals (device, failed logins, activity).
- Ignoring the imprecision of IP geolocation when judging distance/time.
Key takeaways
- Impossible travel flags an account logging in from two locations too far apart to travel between in the elapsed time — suggesting use from two places (possible compromise).
- It uses geolocation and timing of login source IPs; limitations (VPNs, proxies, mobile/cloud, imprecise geolocation) cause false positives.
- It's a lead weighed with context and confidence, corroborated by other signals before concluding compromise — a valuable but nuanced account-compromise indicator.
Check your understanding
- What does impossible travel detect, and what does it rely on?
- Why can VPNs and proxies cause false positives, and how should an analyst weigh the alert?