Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

2/23/2016
12:30 PM
Ting-Fang Yen
Ting-Fang Yen
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Anatomy Of An Account Takeover Attack

How organized crime rings are amassing bot armies for password-cracking attacks on personal accounts in retail, financial, gaming, and other consumer-facing services.

Account takeover attacks (ATO) are a very lucrative business for cybercriminals. They fuel the underground fraud-as-a-service economy with compromised accounts, which are sold or exchanged for a variety of downstream attacks involving retailers, financial services, reward programs, mobile games, and other consumer-facing services. Based on the number of data breaches that took place in 2015, it’s likely that the stolen credentials will be used heavily toward ATO attacks in 2016. 

What makes ATO attacks so dangerous is that they target accounts that are created by real users. Unlike mass-registered fake accounts, they contain valuable information such as financial data, and their activities are less likely to raise the suspicion of security solutions. According to a recent Trend Micro report, a single compromised account is worth upward of $3 each on the underground market. That’s more than 17 times the price of a stolen credit card number, which is only 22 cents.

Compromised takeover accounts are commonly used for financially motivated downstream attacks, including:

Financial fraud: Targets are accounts at financial or e-commerce services that store users’ banking details. The attackers perform unauthorized withdrawal from bank accounts or fraudulent transactions using the credit/debit cards on file.

Spam: Spam can appear in any service feature that accepts user-generated content, including discussion forums, direct messages, and reviews/ratings, degrading platform integrity and brand reputation.

Phishing: Attackers can assume a compromised user’s identity and launch phishing attacks on others in his/her social circle to steal their credentials, personal information, or sensitive data.

Virtual currency fraud: Virtual “currencies” that are worth real money include reward points, promotional credits, and in-game virtual items, which can be harvested for real world gains.

ATO Campaigns

Organized crime rings are performing account takeover at scale by leveraging massive bot armies to attempt password-cracking attacks at various consumer-facing websites. Just how big are these armies? In a mass ATO attack the DataVisor team recently discovered at a large retailer website, bot armies made more than 300,000 login attempts from thousands of IP addresses in the course of a single day. Each IP address was used to attempt logins to approximately 100 distinct user accounts, with a different browser cookie used for every login, likely to skirt security solutions based on device tracking. The map below shows the geographic distribution of the attacking IPs, which are located in residential networks from all over the world.

Map of IPs from a widely-distributed 'password cracking' botnet attack.
Map of IPs from a widely-distributed password cracking botnet attack.

   

The vast majority of the attempts involved accounts that all had valid email addresses registered at this particular retailer. The success rate of the login attempts was not very high, only 8%, so it is likely the attacker obtained the usernames from third-party data breaches. Users that have weak passwords or reuse them at other services are especially at risk (as shown by the recent attack on Fitbit accounts).

Putting Compromised Accounts into Action

After the initial ATO stage of the attack, the same attackers looked to immediately put these stolen credentials to use. In this particular attack, DataVisor detected attempts to validate stolen credit card numbers by testing them within the compromised users’ payment profile page, an attack we refer to as an “oracle test.”

If the credit card is invalid or known to be compromised or stolen, the site will reject the card and display a warning message. This feedback essentially turns the service into an online credit card “oracle” where fraudsters can verify their bulk card purchases from the underground market. This is similar to the attack technique used by botmasters to query public IP blacklists to check whether their spamming bot2s are blacklisted.

Image Source: DataVisor An example of a credit card 'oracle' test.
Image Source: DataVisor
An example of a credit card oracle test.

Beyond Financial Accounts

Compromised accounts are exploited for financial gain, but it’s not only retailers or financial services that are vulnerable and at risk. There are plenty of virtual “currencies” that are worth real money, including reward points that can be converted into merchandise, flights, hotel stays, and gift cards, virtual items in online games that can be sold (sometimes for hundreds of thousands of dollars), and social reputation that can be exploited to boost business sales or ad revenue. This makes most, if not all, consumer-facing services prime targets for ATO attacks.

As the saying goes, “money isn’t everything,” and these attacks can impact more than just the financials for modern online services. With consumers becoming more conscious about their online security and privacy, the impact of ATO to brand name reputation is especially harmful, and will likely to affect user growth and revenue in the long term. 

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Ting-Fang Yen is a director of research at DataVisor, a company providing big data security analytics for online services and financial institutions. Her work focuses on network and information security data analysis, where she combines data science with security domain ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/23/2016 | 2:23:30 PM
Social Engineering
Social Engineering, especially by means of phishing, is extremely effective as it is a standard and regularly used/accepted medium for transmitting data. Due to this, it can be very difficult to tell a phishing attack from a genuine email because the attacks are becoming more and more sophisticated.
HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11547
PUBLISHED: 2020-04-05
PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or index.htm.
CVE-2020-11548
PUBLISHED: 2020-04-05
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
CVE-2020-11542
PUBLISHED: 2020-04-04
3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpretation of the <KEY>MYKEY</KEY> substring.
CVE-2020-11533
PUBLISHED: 2020-04-04
Ivanti Workspace Control before 10.4.30.0, when SCCM integration is enabled, allows local users to obtain sensitive information (keying material).
CVE-2020-11529
PUBLISHED: 2020-04-04
Common/Grav.php in Grav before 1.6.23 has an Open Redirect.