Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //

Authentication

4/8/2019
06:30 PM
Robert Lemos
Robert Lemos
News
100%
0%

Credential-Stuffing Attacks Behind 30 Billion Login Attempts in 2018

Using e-mail addresses and passwords from compromised sites, attackers most often targeted retail sites, video-streaming services, and entertainment companies, according to Akamai.

Credential stuffing — where attackers use e-mail addresses and passwords stolen from one site to attempt to access other sites — took off in 2018, with nearly 30 billion documented attempts recorded by Internet infrastructure firm Akamai, according to its new report.

The attacks are enabled by easy-to-use software and widespread botnets that can take lists of usernames and passwords and try to log into a variety of sites. On average, Akamai saw more than 115 million attempts to use stolen credentials per day, and three times during the year the attacks spiked to more than 250 million attempts per day.

The widespread attempts to log into a variety of services mean that companies need to be on watch, says Martin McKeay, a security researcher and editorial director at Akamai.

"This is not something that just happens to someone else," he says. "This is not something that you can ignore. It is a constant problem."

Attacks that attempt to access sites using stolen or easy-to-guess credentials have become increasingly popular. In March, for example, the FBI warned management-software firm Citrix that attackers had breached the company's network using a low-volume credential-stuffing attack — known as credential spraying — where an attacker sends a relatively low number of attempts to each targeted server. Indoing so, the attacker can avoid triggering hard limits on the number of log-in attempts.

In its recent report, security firm Rapid7 also found that credential stuffing attacks had taken off, ostensibly because so many username-password pairs have been stolen from compromised sites.

"There are now upward of 1.5 billion credentials floating in the wild ready for use by malicious miscreants at an exposed service near your data," the company stated.

Akamai found that attackers most often targeted retail sites, video-streaming services, and entertainment companies. Because the company defined a credential-stuffing attack as a log-in attempt using an e-mail address, financial firms did not show up often in the data set, as most financial firms do not allow customer to log in with an e-mail address.

Online groups are after all sorts of credentials, McKeay says.

"They are looking at getting your streaming credentials, and they are looking for your gaming credentials — there is a large market for these things," he says. "If they can go and prove that what they have is a valid set of credentials, there is money to be made there."

The popularity of credential-stuffing attacks is also driven by easy-to-use software, the Akamai report stated. A tool named SNIPR is a popular entry-level program for targeting the simplest targets, such as gaming networks and video-streaming services. Another tool, known as STORM, allows for custom configurations that are traded and sold on the Dark Web, according to Akamai. 

Other tools are designed to test stolen credentials' validity. Credentials proved to be valid have a much higher value in online black markets. In January, security researchers found a collection of 773 million e-mail addresses and 21 million passwords for sale on the Dark Web. 

Intuit warned users of TurboTax in February that the reuse of usernames and passwords had allowed attackers to compromise an unknown number of accounts. 

"Based on our investigation, it appears that an unauthorized party may have accessed your account by using your username and password combination that was obtained from a non-Intuit source," the company stated in a letter sent to consumers

Akamai urged companies to continue to educate users on the reasons for using unique passwords paired with a password manager. And users should request two-factor authentication whenever a service offers the security measure.

"When discussing [attack takeover] and [all-in-one] scripts, criminals often complain about the use of multifactor authentication, which is a particularly effective method of stopping most of their attacks," the company stated in its report.

Related Content

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/9/2019 | 10:51:47 AM
On Passwords
Alot of home and non-business accounts have the same passwords, in multiple use locations.  Why?  Easy to remember is the sole reason.  Why clutter your mind.  Now this is insane at least users should vary the FORM of the password with special characters and shift things around.  That by itself would do wonders.  I use a word from a known hobby, a special char and an associated number that is wicked easy to modify using, oh, l for a 1 and so forth.   The syntax itself is universal and allows a huge range of variations.  
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11559
PUBLISHED: 2019-09-17
A reflected Cross-site scripting (XSS) vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to the Login component.
CVE-2019-15729
PUBLISHED: 2019-09-17
An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request.
CVE-2016-10983
PUBLISHED: 2019-09-17
The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.
CVE-2016-10984
PUBLISHED: 2019-09-17
The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.
CVE-2016-10985
PUBLISHED: 2019-09-17
The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.