Endpoint
2/23/2016
12:30 PM
Ting-Fang Yen
Ting-Fang Yen
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Anatomy Of An Account Takeover Attack

How organized crime rings are amassing bot armies for password-cracking attacks on personal accounts in retail, financial, gaming, and other consumer-facing services.

Account takeover attacks (ATO) are a very lucrative business for cybercriminals. They fuel the underground fraud-as-a-service economy with compromised accounts, which are sold or exchanged for a variety of downstream attacks involving retailers, financial services, reward programs, mobile games, and other consumer-facing services. Based on the number of data breaches that took place in 2015, it’s likely that the stolen credentials will be used heavily toward ATO attacks in 2016. 

What makes ATO attacks so dangerous is that they target accounts that are created by real users. Unlike mass-registered fake accounts, they contain valuable information such as financial data, and their activities are less likely to raise the suspicion of security solutions. According to a recent Trend Micro report, a single compromised account is worth upward of $3 each on the underground market. That’s more than 17 times the price of a stolen credit card number, which is only 22 cents.

Compromised takeover accounts are commonly used for financially motivated downstream attacks, including:

Financial fraud: Targets are accounts at financial or e-commerce services that store users’ banking details. The attackers perform unauthorized withdrawal from bank accounts or fraudulent transactions using the credit/debit cards on file.

Spam: Spam can appear in any service feature that accepts user-generated content, including discussion forums, direct messages, and reviews/ratings, degrading platform integrity and brand reputation.

Phishing: Attackers can assume a compromised user’s identity and launch phishing attacks on others in his/her social circle to steal their credentials, personal information, or sensitive data.

Virtual currency fraud: Virtual “currencies” that are worth real money include reward points, promotional credits, and in-game virtual items, which can be harvested for real world gains.

ATO Campaigns

Organized crime rings are performing account takeover at scale by leveraging massive bot armies to attempt password-cracking attacks at various consumer-facing websites. Just how big are these armies? In a mass ATO attack the DataVisor team recently discovered at a large retailer website, bot armies made more than 300,000 login attempts from thousands of IP addresses in the course of a single day. Each IP address was used to attempt logins to approximately 100 distinct user accounts, with a different browser cookie used for every login, likely to skirt security solutions based on device tracking. The map below shows the geographic distribution of the attacking IPs, which are located in residential networks from all over the world.

Map of IPs from a widely-distributed 'password cracking' botnet attack.
Map of IPs from a widely-distributed password cracking botnet attack.

   

The vast majority of the attempts involved accounts that all had valid email addresses registered at this particular retailer. The success rate of the login attempts was not very high, only 8%, so it is likely the attacker obtained the usernames from third-party data breaches. Users that have weak passwords or reuse them at other services are especially at risk (as shown by the recent attack on Fitbit accounts).

Putting Compromised Accounts into Action

After the initial ATO stage of the attack, the same attackers looked to immediately put these stolen credentials to use. In this particular attack, DataVisor detected attempts to validate stolen credit card numbers by testing them within the compromised users’ payment profile page, an attack we refer to as an “oracle test.”

If the credit card is invalid or known to be compromised or stolen, the site will reject the card and display a warning message. This feedback essentially turns the service into an online credit card “oracle” where fraudsters can verify their bulk card purchases from the underground market. This is similar to the attack technique used by botmasters to query public IP blacklists to check whether their spamming bot2s are blacklisted.

Image Source: DataVisor An example of a credit card 'oracle' test.
Image Source: DataVisor
An example of a credit card oracle test.

Beyond Financial Accounts

Compromised accounts are exploited for financial gain, but it’s not only retailers or financial services that are vulnerable and at risk. There are plenty of virtual “currencies” that are worth real money, including reward points that can be converted into merchandise, flights, hotel stays, and gift cards, virtual items in online games that can be sold (sometimes for hundreds of thousands of dollars), and social reputation that can be exploited to boost business sales or ad revenue. This makes most, if not all, consumer-facing services prime targets for ATO attacks.

As the saying goes, “money isn’t everything,” and these attacks can impact more than just the financials for modern online services. With consumers becoming more conscious about their online security and privacy, the impact of ATO to brand name reputation is especially harmful, and will likely to affect user growth and revenue in the long term. 

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Ting-Fang Yen is a research scientist at DataVisor, Inc., a startup providing big data security analytics for consumer-facing web and mobile sites. Ting-Fang received a PhD degree in Electrical and Computer Engineering from Carnegie Mellon University, Pittsburgh, PA. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/23/2016 | 2:23:30 PM
Social Engineering
Social Engineering, especially by means of phishing, is extremely effective as it is a standard and regularly used/accepted medium for transmitting data. Due to this, it can be very difficult to tell a phishing attack from a genuine email because the attacks are becoming more and more sophisticated.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.