What is a “Credential Stuffing” Attack and how can you defend against one?
Credential Stuffing occurs when malicious hackers obtain a users’ credentials during a security breach, and use the compromised data to get access to a system. It’s an effective cyberattack that uses automation and scaling bots – and takes advantage of the fact that users tend to use the same login credentials for many services.
Over the years, the security community has witnessed the appearance of many sophisticated bots that can simultaneously attempt multiple logins that originate from other IP addresses. The fact that they are able to break through straightforward security measures, such as prohibiting entry from IP addresses that has too many failed logins, makes it a significant threat.
When dealing with credential stuffing, adopting a multi-layer approach has become necessary. For example, investing in DAST security tools or running your applications on a web server with the purpose of locating vulnerabilities are both great options. The availability of massive databases of breach credentials is another vulnerability you should consider.
Credential stuffing is very similar to a brute force attack, but there are several key differences as well.
While a brute force attack is more likely to succeed when users choose easy-to-guess passwords, credential stuffing attacks are much more sophisticated as they take advantage of users sharing passwords – even if they’re strong – across services, which leads to a compromise.
To carry out large-scale credential stuffing attacks, hackers use a bot that fakes different IP addresses and enters into multiple user accounts automatically in parallel.
Hackers follow this up by executing an automated process to check whether the compromised credentials work on multiple websites in parallel.
With every successful login, a hacker can acquire personal information from hacked accounts. They can keep this information and use it in the future, or carry out other unauthorized activities through compromised devices.
The most effective way to curb the efforts of bad actors is to use a precautionary approach. Online platforms that require a password should carry out routine security checks to identify and patch vulnerabilities.
Credential Stuffing Warning Signs
Credential stuffing is considered one of “the biggest collections of breaches”. Cybercriminals compile hundreds of millions of stolen records and share them for free on hacker forums. This is precisely why you should be aware of the warning signs ASAP:
Track notable site traffic changes, especially multiple login attempts on multiple accounts within a limited time frame.
Find out if there has been a significant increase in site traffic and take note of any recorded downtime as a result.
Analyze cases when there is a higher than usual login failure rate
Another recommendation is to use bot screening, to stop the large number of bots sent by malicious hackers.
Tips to Prevent Credential Stuffing Attacks
If you’re aware of the red flags, you can prevent credentials stuffing attacks by implementing these useful tips:
1.) Set a strong password
Set strict password complexity rules for your password input fields. Using a password manager is vital, as it will sync across all of your devices. Use special characters and longer lengths.
2.) Set up Multi-Factor Authentication
Also known as Two-Factor Authentication, this technique adds another layer of security making it difficult for cybercriminals to penetrate the system. Take the necessary steps to enable this.
3.) Embed security into website design via CAPTCHA
CAPTCHA is a great way to tell whether the user is real or a bot. Because CAPTCHAs can be automated, using reCAPTCHA is a smart tool to implement as well. reCAPTCHA is available in three versions:
An “invisible box”, which is displayed only for suspicious users.
An “I’m not a robot” checkbox.
A “V3” version that can evaluate users on the basis of their behavior and reputation.
4.) Set up “Passwordless Authentication”
The entire basis of Credentials Stuffing is in obtaining information through password vulnerabilities. So why not remove them altogether?
Using passwordless authentication ensures more confined access into user accounts.
5.) Implement Risk-Based Authentication (RBA)
RBA calculates a risk report according to a predefined set of rules, which can be related to anything – a login device, user identity details, geo velocity or geolocation, IP reputation, data sensitivity and so on.
This type of authentication is useful with trying to curb high-risk scenarios by allowing customers to use a customizable password security.
Cybercriminals are always coming up with creative ways to compromise your data. Make sure you take the necessary precautions to protect your website by searching for warning signs. Avoid using devices that are dependent on residential connectivity and implement required policy updates to raise awareness about credential stuffing.
Story via Tripwire
