Vulnerabilities / Threats

5/23/2017
05:10 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Credential-Stuffing Threat Intensifies Amid Password Reuse

Employees who reuse logins on multiple websites drive the impact of third-party breaches as hackers use credential stuffing to compromise more accounts.

Password reuse poses a tremendous security risk as attackers increasingly employ leaked credentials to search for other accounts to compromise via reused passwords.

There's no shortage of leaked credentials for attackers to employ. Nearly all (97%) of the world's 1,000 largest companies have had corporate credentials exposed, Digital Shadows reports in its newly published research on account takeover attacks and mitigation.

Hackers are using this information in six main ways: for building botnets, post-breach extortion, credential harvesting, spearphishing, account takeover, and credential stuffing. This research specifically dives into account takeover, which is increasing with credential-stuffing tools.

Credential stuffing is the process of using automated systems to brute-force a website with login information stolen from another site, hoping it will match with an existing account. It's easy for attackers to automate account takeover by identifying where users employ the same credentials on multiple sites, and spreading their attack to more accounts.

"Barriers to entry have gotten lower and lower," says Michael Marriott, research analyst at Digital Shadows, of account takeover attacks. Threat actors don't need advanced expertise to infiltrate accounts, and they're realizing users' poor security habits will drive their success. With an "obscene amount" of data available online, they're likely to find a match, he says.

Many credentials are publicly available; cost varies depending on their age. For example, Digital Shadows reports the LinkedIn database cost $2,280 in April 2016:  now, you can buy it for a mere $4. One of the most thorough packages costs $2,999 for a total of 3,825,302,948 credentials collected from 1,074 databases.

Attackers use a few different tools to launch credential stuffing attacks, but the main ones are SentryMBA, Vertex Cracker, and Account Hitman. Marriott says the most popular is SentryMBA, which is free and designed to bypass the CAPTCHA controls implemented to stop automated logins.

"There are different motivations, but making money is an obvious one," says Marriott of what's driving these attacks. "People also use account takeover to find out more information about users. If you want to tailor an attack more, you can log on to different accounts."

Technically skilled people can make money by selling a website's configuration files, which maps out the specific parts of a site so credential-stuffing software knows where to attempt logins. Those who don't have the tech-savvy to create these files can buy them on forums, marketplaces, and social media.

Credential stuffing affects businesses of all sizes and industries across the board. Gaming and technology businesses were most frequently targeted, but attackers also went after gift card companies, hotels, pizza shops, and online retailers. The most vulnerable websites are those with an employee or customer login page, which are open to account takeover attempts.

Multi-factor authentication is one means of fighting account takeover attacks; however, Marriott warns against using this as a "silver bullet" to get full protection.

"If [businesses] don't have multi-factor authentication, it's not because they haven't thought about it," he explains. Oftentimes companies decide against it because it leads to loss of customers; in some cases, like with SMS authentication, it may not even be that effective.

There are other ways to detect and protect against account takeover attempts. Marriott recommends companies check Have I been pwned for signs of email compromise, and use Google Alerts to check for mentions of company and brand names across cracking forums. This will give you a heads-up if someone is discussing a potential attack on your business.

He also advises organizations to learn more about credential-stuffing tools and inform staff and consumers of the dangers of reusing passwords and corporate email addresses for personal accounts.

Related Content

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11358
PUBLISHED: 2019-04-20
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVE-2019-11359
PUBLISHED: 2019-04-20
Cross-site scripting (XSS) vulnerability in display.php in I, Librarian 4.10 allows remote attackers to inject arbitrary web script or HTML via the project parameter.
CVE-2018-20817
PUBLISHED: 2019-04-19
SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern W...
CVE-2019-11354
PUBLISHED: 2019-04-19
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices ...
CVE-2019-11350
PUBLISHED: 2019-04-19
CloudBees Jenkins Operations Center 2.150.2.3, when an expired trial license exists, allows Cleartext Password Storage and Retrieval via the proxy configuration page.