Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

2/23/2016
12:30 PM
Ting-Fang Yen
Ting-Fang Yen
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Anatomy Of An Account Takeover Attack

How organized crime rings are amassing bot armies for password-cracking attacks on personal accounts in retail, financial, gaming, and other consumer-facing services.

Account takeover attacks (ATO) are a very lucrative business for cybercriminals. They fuel the underground fraud-as-a-service economy with compromised accounts, which are sold or exchanged for a variety of downstream attacks involving retailers, financial services, reward programs, mobile games, and other consumer-facing services. Based on the number of data breaches that took place in 2015, it’s likely that the stolen credentials will be used heavily toward ATO attacks in 2016. 

What makes ATO attacks so dangerous is that they target accounts that are created by real users. Unlike mass-registered fake accounts, they contain valuable information such as financial data, and their activities are less likely to raise the suspicion of security solutions. According to a recent Trend Micro report, a single compromised account is worth upward of $3 each on the underground market. That’s more than 17 times the price of a stolen credit card number, which is only 22 cents.

Compromised takeover accounts are commonly used for financially motivated downstream attacks, including:

Financial fraud: Targets are accounts at financial or e-commerce services that store users’ banking details. The attackers perform unauthorized withdrawal from bank accounts or fraudulent transactions using the credit/debit cards on file.

Spam: Spam can appear in any service feature that accepts user-generated content, including discussion forums, direct messages, and reviews/ratings, degrading platform integrity and brand reputation.

Phishing: Attackers can assume a compromised user’s identity and launch phishing attacks on others in his/her social circle to steal their credentials, personal information, or sensitive data.

Virtual currency fraud: Virtual “currencies” that are worth real money include reward points, promotional credits, and in-game virtual items, which can be harvested for real world gains.

ATO Campaigns

Organized crime rings are performing account takeover at scale by leveraging massive bot armies to attempt password-cracking attacks at various consumer-facing websites. Just how big are these armies? In a mass ATO attack the DataVisor team recently discovered at a large retailer website, bot armies made more than 300,000 login attempts from thousands of IP addresses in the course of a single day. Each IP address was used to attempt logins to approximately 100 distinct user accounts, with a different browser cookie used for every login, likely to skirt security solutions based on device tracking. The map below shows the geographic distribution of the attacking IPs, which are located in residential networks from all over the world.

Map of IPs from a widely-distributed 'password cracking' botnet attack.
Map of IPs from a widely-distributed password cracking botnet attack.

   

The vast majority of the attempts involved accounts that all had valid email addresses registered at this particular retailer. The success rate of the login attempts was not very high, only 8%, so it is likely the attacker obtained the usernames from third-party data breaches. Users that have weak passwords or reuse them at other services are especially at risk (as shown by the recent attack on Fitbit accounts).

Putting Compromised Accounts into Action

After the initial ATO stage of the attack, the same attackers looked to immediately put these stolen credentials to use. In this particular attack, DataVisor detected attempts to validate stolen credit card numbers by testing them within the compromised users’ payment profile page, an attack we refer to as an “oracle test.”

If the credit card is invalid or known to be compromised or stolen, the site will reject the card and display a warning message. This feedback essentially turns the service into an online credit card “oracle” where fraudsters can verify their bulk card purchases from the underground market. This is similar to the attack technique used by botmasters to query public IP blacklists to check whether their spamming bot2s are blacklisted.

Image Source: DataVisor An example of a credit card 'oracle' test.
Image Source: DataVisor
An example of a credit card oracle test.

Beyond Financial Accounts

Compromised accounts are exploited for financial gain, but it’s not only retailers or financial services that are vulnerable and at risk. There are plenty of virtual “currencies” that are worth real money, including reward points that can be converted into merchandise, flights, hotel stays, and gift cards, virtual items in online games that can be sold (sometimes for hundreds of thousands of dollars), and social reputation that can be exploited to boost business sales or ad revenue. This makes most, if not all, consumer-facing services prime targets for ATO attacks.

As the saying goes, “money isn’t everything,” and these attacks can impact more than just the financials for modern online services. With consumers becoming more conscious about their online security and privacy, the impact of ATO to brand name reputation is especially harmful, and will likely to affect user growth and revenue in the long term. 

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Ting-Fang Yen is a director of research at DataVisor, a company providing big data security analytics for online services and financial institutions. Her work focuses on network and information security data analysis, where she combines data science with security domain ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
2/23/2016 | 2:23:30 PM
Social Engineering
Social Engineering, especially by means of phishing, is extremely effective as it is a standard and regularly used/accepted medium for transmitting data. Due to this, it can be very difficult to tell a phishing attack from a genuine email because the attacks are becoming more and more sophisticated.
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Virginia a Hot Spot For Cybersecurity Jobs
Jai Vijayan, Contributing Writer,  10/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14832
PUBLISHED: 2019-10-15
A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.
CVE-2017-10022
PUBLISHED: 2019-10-15
In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing ...
CVE-2019-10759
PUBLISHED: 2019-10-15
safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
CVE-2019-10760
PUBLISHED: 2019-10-15
safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
CVE-2019-17397
PUBLISHED: 2019-10-15
In the DoorDash application through 11.5.2 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.