Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //

Authentication

4/8/2019
06:30 PM
Robert Lemos
Robert Lemos
News
100%
0%

Credential-Stuffing Attacks Behind 30 Billion Login Attempts in 2018

Using e-mail addresses and passwords from compromised sites, attackers most often targeted retail sites, video-streaming services, and entertainment companies, according to Akamai.

Credential stuffing — where attackers use e-mail addresses and passwords stolen from one site to attempt to access other sites — took off in 2018, with nearly 30 billion documented attempts recorded by Internet infrastructure firm Akamai, according to its new report.

The attacks are enabled by easy-to-use software and widespread botnets that can take lists of usernames and passwords and try to log into a variety of sites. On average, Akamai saw more than 115 million attempts to use stolen credentials per day, and three times during the year the attacks spiked to more than 250 million attempts per day.

The widespread attempts to log into a variety of services mean that companies need to be on watch, says Martin McKeay, a security researcher and editorial director at Akamai.

"This is not something that just happens to someone else," he says. "This is not something that you can ignore. It is a constant problem."

Attacks that attempt to access sites using stolen or easy-to-guess credentials have become increasingly popular. In March, for example, the FBI warned management-software firm Citrix that attackers had breached the company's network using a low-volume credential-stuffing attack — known as credential spraying — where an attacker sends a relatively low number of attempts to each targeted server. Indoing so, the attacker can avoid triggering hard limits on the number of log-in attempts.

In its recent report, security firm Rapid7 also found that credential stuffing attacks had taken off, ostensibly because so many username-password pairs have been stolen from compromised sites.

"There are now upward of 1.5 billion credentials floating in the wild ready for use by malicious miscreants at an exposed service near your data," the company stated.

Akamai found that attackers most often targeted retail sites, video-streaming services, and entertainment companies. Because the company defined a credential-stuffing attack as a log-in attempt using an e-mail address, financial firms did not show up often in the data set, as most financial firms do not allow customer to log in with an e-mail address.

Online groups are after all sorts of credentials, McKeay says.

"They are looking at getting your streaming credentials, and they are looking for your gaming credentials — there is a large market for these things," he says. "If they can go and prove that what they have is a valid set of credentials, there is money to be made there."

The popularity of credential-stuffing attacks is also driven by easy-to-use software, the Akamai report stated. A tool named SNIPR is a popular entry-level program for targeting the simplest targets, such as gaming networks and video-streaming services. Another tool, known as STORM, allows for custom configurations that are traded and sold on the Dark Web, according to Akamai. 

Other tools are designed to test stolen credentials' validity. Credentials proved to be valid have a much higher value in online black markets. In January, security researchers found a collection of 773 million e-mail addresses and 21 million passwords for sale on the Dark Web. 

Intuit warned users of TurboTax in February that the reuse of usernames and passwords had allowed attackers to compromise an unknown number of accounts. 

"Based on our investigation, it appears that an unauthorized party may have accessed your account by using your username and password combination that was obtained from a non-Intuit source," the company stated in a letter sent to consumers

Akamai urged companies to continue to educate users on the reasons for using unique passwords paired with a password manager. And users should request two-factor authentication whenever a service offers the security measure.

"When discussing [attack takeover] and [all-in-one] scripts, criminals often complain about the use of multifactor authentication, which is a particularly effective method of stopping most of their attacks," the company stated in its report.

Related Content

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/9/2019 | 10:51:47 AM
On Passwords
Alot of home and non-business accounts have the same passwords, in multiple use locations.  Why?  Easy to remember is the sole reason.  Why clutter your mind.  Now this is insane at least users should vary the FORM of the password with special characters and shift things around.  That by itself would do wonders.  I use a word from a known hobby, a special char and an associated number that is wicked easy to modify using, oh, l for a 1 and so forth.   The syntax itself is universal and allows a huge range of variations.  
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Lessons from the NSA: Know Your Assets
Robert Lemos, Contributing Writer,  12/12/2019
4 Tips to Run Fast in the Face of Digital Transformation
Shane Buckley, President & Chief Operating Officer, Gigamon,  12/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
CVE-2019-5254
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...