Credential stuffing is a technique cybercriminals use to take over user accounts at one organization using fraudulently acquired usernames and passwords from a different organization. This sensitive information is mainly obtained from the dark web or through a data breach.
Credential stuffing attacks are the leading cause of data breaches since over 60 percent of people use the same password on different accounts. Cyber Attackers have taken advantage of that and are now reaping big from this malicious act. According to recent studies, approximately 50 percent of all login requests made at various platforms daily are attempts at credential stuffing.
Currently, credential stuffing is at its peak due to the ever-growing list of credentials being exposed through breaches. This has prompted potential cybercriminals to venture into this area due to the ease of accessibility to billions of compromised credentials trending on the dark web.
Fortunately, credential stuffing attacks can be prevented through the implementation of the appropriate cybersecurity measures. In this article, we’ll discuss in detail what organizations need to know about credential stuffing attacks and what can be done to minimize or impede the possibility of their organizations falling victim to this malicious act.
How Credential Stuffing Works
In order to carry out a credential stuffing attack, cybercriminals insert a list of stolen credentials (username and password) into a botnet that automates the act of trying those details on various sites simultaneously. When executed on a large scale, botnet attacks can overpower a business IT infrastructure, with websites enduring unbearable traffic during an attack compared to regular traffic.
Immediately cybercriminals discover a site where a good number of credentials work; they’ll quickly gain access to the users’ accounts and confidential data and use it for their gain in the following ways:
- Granting access to hacked accounts at a fee: Media streaming services are the primary victim of this deceptive act. Top media streaming service providers, such as Spotify, Netflix, and Disney+ have faced endless attacks from cybercriminals. At some point, hackers granted access to user accounts for a fraction of the subscription fee.
- E-commerce fraud: Cybercriminals can mimic authentic users at retailers’ websites and order valuable commodities, either for personal use or reselling. According to the research, this is a typical kind of identity theft, which renders retail the most susceptible to credential staffing.
- Corporate/institutional surveillance and theft. Although the offenses above have severe implications for businesses and their customers, this form of attack is likely the most destructive for enterprises. Successful takeover of an employee or admin account by a hacker can lead to unauthorized access to all sorts of confidential information, such as login details, social security numbers, credit card numbers, and more. These details can then be sold at a cut-price fee to the interested parties.
How to Curb Credential Stuffing Attacks
We all know that reusing the same password on multiple accounts is risky. Still, because we don’t want to burden ourselves with so many things to remember, we often overlook the potential threat and keep using the same password on different sites. Password managers are an alternative, but embracement rates are pretty insignificant. Therefore, organizations need to embrace measures to nullify credential stuffing attacks, such as scrapping passwords completely to ensure fraudulently obtained credentials cannot be used to access customers’ accounts. That said, below are the most effective methods for preventing credential stuffing attacks.
Passwordless Authentication
Passwordless authentication can help stop credential stuffing in totality because it uses other means, such as biometrics, devices, or other accounts, to verify a user. Also, passwordless provides users with a fantastic login experience and saves companies the resources incurred on password resets.
Continuous Authentication
Rather than a password, continuous authentication systems use behavioral patterns, biometrics among other factors, to confirm a user’s identity in real-time. With continuous authentication, credential stuffing attacks may no longer be a feasible technique for cybercriminals to gain irregular access to a customer’s account.
Multi-Factor Authentication (MFA)
Multi-factor authentication is an incredibly viable technique to impede credential stuffing altogether because, besides a username-password combination, it subjects users to another form of identification. For instance, this could entail biometric authentication, like a fingerprint, a unique code delivered to a device connected with the user, or probably an email conveyed to a secured account, all of which a cybercriminal has no access to.
While the FMA embracement rate has not been impressive because of the issues regarding its impact on user’s experience, the intensification in sophistication and customizability of MFA will undoubtedly help to get it on track. For example, in February 2020, Google declared that all Nest smart home users would be using two-factor authentication to access their accounts.
Breached Password Protection
This method collates the password a user uses to sign in against databases of disputed credentials to hamper credential stuffing in real-time. When a password breach is detected, the breached password protection sends a notification to the user, blocks them from signing in, or requests more authentication information if the sign-in attempt originated from a fraudulent IP address.
Prohibit Use of Email Addresses as User IDs
Credential stuffing depends heavily on the continuous use of the same credentials on multiple sites. This is likely to be the case if the account username is an email address. By prohibiting the usage of email addresses as IDs, you can significantly negate the prospect of them using the same ID/password combination on another platform.
Use of CAPTCHA
CAPTCHA is another form of authentication that demands users to execute an action to demonstrate that they are human and not robots. And because cybercriminals use automated systems to perform credential stuffing attacks, the use of CAPTCHA will definitely thwart their malicious attempts and possibly raise a red flag when such requests are made. However, cybercriminals can quickly navigate CAPTCHA by using headless browsers. But when used alongside other methods for credential stuffing prevention, CAPTCHA can prove effective in combating credential stuffing attacks.
Conclusion
From the above, it’s apparent that credential stuffing is a severe security threat to any business or organization that keeps vast volumes of data for its customers. However, the good news is that credential stuffing is preventable, and all an organization needs is to adopt the discussed above prevention methods.