The internet is an amazing place. Not only does it help us communicate more quickly, but it also empowers us to do things that were otherwise impossible without access to large amounts of capital or physical resources.
Since the rise of the Internet in the 1990s, people have sought out ways to exploit this new medium for personal gain. Cybercriminals are no different than any other group of people; they want to get things done quickly and easily.
One strategy criminals employ is launching a credential stuffing attack.
What is a credential stuffing attack?
A credential stuffing attack is when a cybercriminal takes valid account information collected from one site and tries to use it on another site. Credential stuffing attacks are conducted by the use of botnets, programs that imbue computers with the ability to follow simple commands. Botnets are often made up of millions of compromised machines.
In a credential stuffing attack, a cybercriminal will first collect valid usernames and passwords from a targeted site by placing malware on that site or conducting an SQL injection. The cybercriminal will then use those credentials on another site, hoping that the user reused his or her password.
The success of a credential stuffing attack depends on how many accounts are available for reuse. The more accounts that were registered using the same password, the better chance hackers have to successfully reuse one of them for access through another website.
For example, if cybercriminals gain access to the login credentials of users of Site A, they can try logging in with those same credentials on Site B.
When you hear about large-scale data breaches that involve millions of accounts, this is probably how the cybercriminals got the information in the first place. They used it to launch credential stuffing attacks across many sites simultaneously and made off with millions of people’s personal data.
Example of credential stuffing attack
There are a lot of ways in which cybercriminals can exploit a data breach. One example is to sell the data on the Dark Web, maybe even by subscription. This is called credential stuffing because it’s done using stolen passwords and user ID combinations from another site. In this way, cybercriminals get into accounts that they wouldn’t have been able to access otherwise.
Although it’s not as profitable as selling data on the Dark Web, credential stuffing is easier and quicker. This makes it a more attractive option for cybercriminals who want to make some quick cash by stealing online identities.
Ways to detect a credential stuffing attack
As mentioned above, cybercriminals use botnets to carry out credential stuffing attacks. These are applications that are capable of inputting data into the targeted site at a high rate of speed, making it easier for them to steal information.
So, to detect a credential stuffing attack, it is important to watch out for high numbers of failed login attempts in a short period of time.
Additionally, since cybercriminals often use data breaches as the foundation for their attacks, you should also monitor when new breaches are reported online. This would be an indication that your site might already have been breached even though you haven’t detected it yet.
And, of course, checking your site for malware is essential when it comes to detecting a credential stuffing attack. Cybercriminals can use malware to gain access to user credentials and other sensitive information that they use in their attacks.
There’s no way to know when you’re faced with an isolated large data breach or if hackers have already used your information in a credential stuffing attack. However, you should always be on the lookout for signs of suspicious activity on your site.
7 Ways to mitigate credential stuffing attacks
Since we have established that credential stuffing attacks are reliant on known data breaches, countermeasures should focus on the prevention of such data breaches.
Here are seven ways to mitigate credential stuffing attacks:
1. Use two-factor authentication wherever appropriate
One of the main issues is that many people use their credentials (username and password) on multiple sites. Since even complex passwords can be hacked with simple phishing or brute-force methods, using two-factor authentication provides an additional layer of security.
2. Train your users not to reuse their passwords or to change them often
One way to combat credential stuffing is to get users to create strong passwords and use them only for specific accounts. To accomplish this, they will need training from your company on how to keep their passwords secure.
3. Monitor login attempts closely
A large number of failed login attempts within a short period of time might indicate a cybercriminal attack using stolen credentials. This is because one of the main tenets of credential stuffing is to test stolen credentials against multiple sites at once.
4. Use captcha or similar security checks
These can help identify humans vs bots by requiring users to perform a specific task before granting them access to log in. Bots are usually not able to figure out these tasks, whereas humans can.
5. Use a cloud-based solution to detect malware
Malware is one of the most common ways that cybercriminals gain access to your site. To prevent this, you can use a security platform that will monitor your site for malware and other suspicious activity before it becomes a problem.
6. Monitor data breaches closely
You should always be on the lookout for new data breaches, particularly those affecting your industry. If you see a breach has been made public, go back to your logs to see if any of the stolen credentials match yours and monitor that location accordingly.
7. Use data encryption
Since we know that most cybercriminals use keyloggers or other types of malware to gain access to login credentials, you should always use data encryption. This will help protect your users’ sensitive information in the event of a cyberattack.
Though there are other measures, these are some good places to start for protecting your site against a future credential stuffing attack.
Wrapping up
Credential stuffing attacks are a type of cyberattack that has been gaining popularity in the last few years. As data breaches become more common, cybercriminals will continue to use this attack method because it’s almost guaranteed to have success.
However, there are some measures you can take to mitigate these attacks from wreaking havoc on your site, including offering two-factor authentication, training your users to create strong passwords, and monitoring login attempts.
Make sure you always keep an eye out for new data breaches in your industry and implement the appropriate security measures before it’s too late.