Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/23/2017
05:10 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Credential-Stuffing Threat Intensifies Amid Password Reuse

Employees who reuse logins on multiple websites drive the impact of third-party breaches as hackers use credential stuffing to compromise more accounts.

Password reuse poses a tremendous security risk as attackers increasingly employ leaked credentials to search for other accounts to compromise via reused passwords.

There's no shortage of leaked credentials for attackers to employ. Nearly all (97%) of the world's 1,000 largest companies have had corporate credentials exposed, Digital Shadows reports in its newly published research on account takeover attacks and mitigation.

Hackers are using this information in six main ways: for building botnets, post-breach extortion, credential harvesting, spearphishing, account takeover, and credential stuffing. This research specifically dives into account takeover, which is increasing with credential-stuffing tools.

Credential stuffing is the process of using automated systems to brute-force a website with login information stolen from another site, hoping it will match with an existing account. It's easy for attackers to automate account takeover by identifying where users employ the same credentials on multiple sites, and spreading their attack to more accounts.

"Barriers to entry have gotten lower and lower," says Michael Marriott, research analyst at Digital Shadows, of account takeover attacks. Threat actors don't need advanced expertise to infiltrate accounts, and they're realizing users' poor security habits will drive their success. With an "obscene amount" of data available online, they're likely to find a match, he says.

Many credentials are publicly available; cost varies depending on their age. For example, Digital Shadows reports the LinkedIn database cost $2,280 in April 2016:  now, you can buy it for a mere $4. One of the most thorough packages costs $2,999 for a total of 3,825,302,948 credentials collected from 1,074 databases.

Attackers use a few different tools to launch credential stuffing attacks, but the main ones are SentryMBA, Vertex Cracker, and Account Hitman. Marriott says the most popular is SentryMBA, which is free and designed to bypass the CAPTCHA controls implemented to stop automated logins.

"There are different motivations, but making money is an obvious one," says Marriott of what's driving these attacks. "People also use account takeover to find out more information about users. If you want to tailor an attack more, you can log on to different accounts."

Technically skilled people can make money by selling a website's configuration files, which maps out the specific parts of a site so credential-stuffing software knows where to attempt logins. Those who don't have the tech-savvy to create these files can buy them on forums, marketplaces, and social media.

Credential stuffing affects businesses of all sizes and industries across the board. Gaming and technology businesses were most frequently targeted, but attackers also went after gift card companies, hotels, pizza shops, and online retailers. The most vulnerable websites are those with an employee or customer login page, which are open to account takeover attempts.

Multi-factor authentication is one means of fighting account takeover attacks; however, Marriott warns against using this as a "silver bullet" to get full protection.

"If [businesses] don't have multi-factor authentication, it's not because they haven't thought about it," he explains. Oftentimes companies decide against it because it leads to loss of customers; in some cases, like with SMS authentication, it may not even be that effective.

There are other ways to detect and protect against account takeover attempts. Marriott recommends companies check Have I been pwned for signs of email compromise, and use Google Alerts to check for mentions of company and brand names across cracking forums. This will give you a heads-up if someone is discussing a potential attack on your business.

He also advises organizations to learn more about credential-stuffing tools and inform staff and consumers of the dangers of reusing passwords and corporate email addresses for personal accounts.

Related Content

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...