Endpoint

2/23/2016
12:30 PM
Ting-Fang Yen
Ting-Fang Yen
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Anatomy Of An Account Takeover Attack

How organized crime rings are amassing bot armies for password-cracking attacks on personal accounts in retail, financial, gaming, and other consumer-facing services.

Account takeover attacks (ATO) are a very lucrative business for cybercriminals. They fuel the underground fraud-as-a-service economy with compromised accounts, which are sold or exchanged for a variety of downstream attacks involving retailers, financial services, reward programs, mobile games, and other consumer-facing services. Based on the number of data breaches that took place in 2015, it’s likely that the stolen credentials will be used heavily toward ATO attacks in 2016. 

What makes ATO attacks so dangerous is that they target accounts that are created by real users. Unlike mass-registered fake accounts, they contain valuable information such as financial data, and their activities are less likely to raise the suspicion of security solutions. According to a recent Trend Micro report, a single compromised account is worth upward of $3 each on the underground market. That’s more than 17 times the price of a stolen credit card number, which is only 22 cents.

Compromised takeover accounts are commonly used for financially motivated downstream attacks, including:

Financial fraud: Targets are accounts at financial or e-commerce services that store users’ banking details. The attackers perform unauthorized withdrawal from bank accounts or fraudulent transactions using the credit/debit cards on file.

Spam: Spam can appear in any service feature that accepts user-generated content, including discussion forums, direct messages, and reviews/ratings, degrading platform integrity and brand reputation.

Phishing: Attackers can assume a compromised user’s identity and launch phishing attacks on others in his/her social circle to steal their credentials, personal information, or sensitive data.

Virtual currency fraud: Virtual “currencies” that are worth real money include reward points, promotional credits, and in-game virtual items, which can be harvested for real world gains.

ATO Campaigns

Organized crime rings are performing account takeover at scale by leveraging massive bot armies to attempt password-cracking attacks at various consumer-facing websites. Just how big are these armies? In a mass ATO attack the DataVisor team recently discovered at a large retailer website, bot armies made more than 300,000 login attempts from thousands of IP addresses in the course of a single day. Each IP address was used to attempt logins to approximately 100 distinct user accounts, with a different browser cookie used for every login, likely to skirt security solutions based on device tracking. The map below shows the geographic distribution of the attacking IPs, which are located in residential networks from all over the world.

Map of IPs from a widely-distributed 'password cracking' botnet attack.
Map of IPs from a widely-distributed password cracking botnet attack.

   

The vast majority of the attempts involved accounts that all had valid email addresses registered at this particular retailer. The success rate of the login attempts was not very high, only 8%, so it is likely the attacker obtained the usernames from third-party data breaches. Users that have weak passwords or reuse them at other services are especially at risk (as shown by the recent attack on Fitbit accounts).

Putting Compromised Accounts into Action

After the initial ATO stage of the attack, the same attackers looked to immediately put these stolen credentials to use. In this particular attack, DataVisor detected attempts to validate stolen credit card numbers by testing them within the compromised users’ payment profile page, an attack we refer to as an “oracle test.”

If the credit card is invalid or known to be compromised or stolen, the site will reject the card and display a warning message. This feedback essentially turns the service into an online credit card “oracle” where fraudsters can verify their bulk card purchases from the underground market. This is similar to the attack technique used by botmasters to query public IP blacklists to check whether their spamming bot2s are blacklisted.

Image Source: DataVisor An example of a credit card 'oracle' test.
Image Source: DataVisor
An example of a credit card oracle test.

Beyond Financial Accounts

Compromised accounts are exploited for financial gain, but it’s not only retailers or financial services that are vulnerable and at risk. There are plenty of virtual “currencies” that are worth real money, including reward points that can be converted into merchandise, flights, hotel stays, and gift cards, virtual items in online games that can be sold (sometimes for hundreds of thousands of dollars), and social reputation that can be exploited to boost business sales or ad revenue. This makes most, if not all, consumer-facing services prime targets for ATO attacks.

As the saying goes, “money isn’t everything,” and these attacks can impact more than just the financials for modern online services. With consumers becoming more conscious about their online security and privacy, the impact of ATO to brand name reputation is especially harmful, and will likely to affect user growth and revenue in the long term. 

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Ting-Fang Yen is a research scientist at DataVisor, Inc., a startup providing big data security analytics for consumer-facing web and mobile sites. Ting-Fang received a PhD degree in Electrical and Computer Engineering from Carnegie Mellon University, Pittsburgh, PA. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/23/2016 | 2:23:30 PM
Social Engineering
Social Engineering, especially by means of phishing, is extremely effective as it is a standard and regularly used/accepted medium for transmitting data. Due to this, it can be very difficult to tell a phishing attack from a genuine email because the attacks are becoming more and more sophisticated.
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
How Data Breaches Affect the Enterprise
How Data Breaches Affect the Enterprise
This report, offers new data on the frequency of data breaches, the losses they cause, and the steps that organizations are taking to prevent them in the future. Read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17182
PUBLISHED: 2018-09-19
An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations...
CVE-2018-17144
PUBLISHED: 2018-09-19
Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash.
CVE-2017-3912
PUBLISHED: 2018-09-18
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
CVE-2018-6690
PUBLISHED: 2018-09-18
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.
CVE-2018-6693
PUBLISHED: 2018-09-18
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escal...