Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/23/2017
05:10 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Credential-Stuffing Threat Intensifies Amid Password Reuse

Employees who reuse logins on multiple websites drive the impact of third-party breaches as hackers use credential stuffing to compromise more accounts.

Password reuse poses a tremendous security risk as attackers increasingly employ leaked credentials to search for other accounts to compromise via reused passwords.

There's no shortage of leaked credentials for attackers to employ. Nearly all (97%) of the world's 1,000 largest companies have had corporate credentials exposed, Digital Shadows reports in its newly published research on account takeover attacks and mitigation.

Hackers are using this information in six main ways: for building botnets, post-breach extortion, credential harvesting, spearphishing, account takeover, and credential stuffing. This research specifically dives into account takeover, which is increasing with credential-stuffing tools.

Credential stuffing is the process of using automated systems to brute-force a website with login information stolen from another site, hoping it will match with an existing account. It's easy for attackers to automate account takeover by identifying where users employ the same credentials on multiple sites, and spreading their attack to more accounts.

"Barriers to entry have gotten lower and lower," says Michael Marriott, research analyst at Digital Shadows, of account takeover attacks. Threat actors don't need advanced expertise to infiltrate accounts, and they're realizing users' poor security habits will drive their success. With an "obscene amount" of data available online, they're likely to find a match, he says.

Many credentials are publicly available; cost varies depending on their age. For example, Digital Shadows reports the LinkedIn database cost $2,280 in April 2016:  now, you can buy it for a mere $4. One of the most thorough packages costs $2,999 for a total of 3,825,302,948 credentials collected from 1,074 databases.

Attackers use a few different tools to launch credential stuffing attacks, but the main ones are SentryMBA, Vertex Cracker, and Account Hitman. Marriott says the most popular is SentryMBA, which is free and designed to bypass the CAPTCHA controls implemented to stop automated logins.

"There are different motivations, but making money is an obvious one," says Marriott of what's driving these attacks. "People also use account takeover to find out more information about users. If you want to tailor an attack more, you can log on to different accounts."

Technically skilled people can make money by selling a website's configuration files, which maps out the specific parts of a site so credential-stuffing software knows where to attempt logins. Those who don't have the tech-savvy to create these files can buy them on forums, marketplaces, and social media.

Credential stuffing affects businesses of all sizes and industries across the board. Gaming and technology businesses were most frequently targeted, but attackers also went after gift card companies, hotels, pizza shops, and online retailers. The most vulnerable websites are those with an employee or customer login page, which are open to account takeover attempts.

Multi-factor authentication is one means of fighting account takeover attacks; however, Marriott warns against using this as a "silver bullet" to get full protection.

"If [businesses] don't have multi-factor authentication, it's not because they haven't thought about it," he explains. Oftentimes companies decide against it because it leads to loss of customers; in some cases, like with SMS authentication, it may not even be that effective.

There are other ways to detect and protect against account takeover attempts. Marriott recommends companies check Have I been pwned for signs of email compromise, and use Google Alerts to check for mentions of company and brand names across cracking forums. This will give you a heads-up if someone is discussing a potential attack on your business.

He also advises organizations to learn more about credential-stuffing tools and inform staff and consumers of the dangers of reusing passwords and corporate email addresses for personal accounts.

Related Content

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.