Blog
In the modern-day internet landscape, data breaches are an unfortunate reality for a lot of companies. Besides crippling enterprises by nibbling at the personal credentials of their users, such attacks dent their reputation, too. According to a report, over 80 percent of data breaches involve attacks using stolen credentials. Credential stuffing today is one of the most ominous attack vectors, which relies on stolen credentials to infiltrate user accounts. Here is a quick walkthrough of what credential stuffing is and how to protect your enterprise from an attack.
What is credential stuffing?
Credential stuffing is a type of cyberattack where an attacker uses automated bots to leverage compromised user credentials to breach victims' accounts. Cybercriminals use the breached credentials of one service to attack the other accounts belonging to users through automated bots. For example, suppose an attacker has compromised a database of usernames and passwords. That attacker will use these credentials and stuff them into an automated bot, which will keep performing log-in attempts to access various other accounts of the same users. According to a report, only 2% of the credential stuffing attempts have resulted in successful log-ins.
You must be wondering why credential stuffing is a concern when the success rate is so low. Over the past few years, a steep rise in data breaches and compromised databases has led to an increase in credential stuffing attacks. According to TechRepublic, nearly 8.5 billion usernames & passwords got leaked in plaintext in just one instance and are publicly available. Another reason why credential stuffing has become popular is that roughly 65 percent of all users reuse the same password on multiple (and sometimes all) accounts.
See more about Password Security: Does your Organization follow Ontario’s Security Standards?
How is credential stuffing different from brute force?
Both credential stuffing and brute force are automated techniques that help hackers compromise user accounts through sensitive user data. But there are subtle differences between the two.
The brute force attack technique tries to guess log-in credentials with no context or previous record of the log-in data. It uses random strings to match the password patterns. The success of a brute force attack depends on whether the password is simple and easy to guess or not.
Credential stuffing attempts to compromise accounts with pre-existing compromised passwords and PINs. The success of credential stuffing depends on whether the victim has set the compromised password for different accounts or not.
How to detect credential stuffing?
There are various ways security professionals and IT teams can detect credential stuffing. A few include:
Enterprises often cater to endpoint solutions with corporate laptops. The security team can detect an abnormal number of log-in attempts from a single source while monitoring or scrutinizing the system
Various security tools like IAM, which use AI, can help security professionals detect unusual access and use of digital identities
Many companies use automated attempt detection systems to trigger alert notifications or send emails when credential stuffing bots attempt infiltration
Companies can contact cybersecurity expert Packetlabs, whose team can help detect credential stuffing attacks using their proprietary methodologies and techniques.
Techniques to prevent credential stuffing attacks
There are several best practices and strategies enterprises can use to minimize credential stuffing attacks. A few include:
Companies can promote password-less authentication techniques rather than credential-based authentication techniques
Companies can use different data masking algorithms with encryption on credential-stored databases so that even if they get compromised, cybercriminals won't be able to extract data for credential stuffing
Multi-factor authentication (MFA) is another approach that can help prevent user accounts from automated credential stuffing attacks
If the attacker doesn't change the IP address during credential stuffing, IP blacklisting is an excellent solution to prevent an attack
Identifying devices through device fingerprinting and blocking them from attempting credential stuffing is an alternative solution. It works even when credential stuffing bots keep changing their IP
Developers can create a separate module that can detect automated tries or multiple attempts on the application and notify the admin or block that IP
The use of CAPTCHA and reCAPTCHA are excellent ways of preventing credential stuffing
Usually, bots leverage non-residential traffic that originates from cloud services and data centres. Modern security systems can easily detect and limit attempts on those traffics
Headless browsers such as PhantomJS often help with software testing. They can effortlessly identify JavaScript calls and automate control of web pages. Often credential stuffing uses these browsers to automate attacks. Companies can block using headless browsers while using their corporate emails for log-in
Companies can provide more education about cybersecurity and password best practices
See more about: Why do you need a password manager?
Conclusion
While credential stuffing attacks are becoming more common, using some of the best practices and strategies listed above can make it difficult or near impossible for an attacker to be successful. As always, being proactive and using a layered approach to security is the best way to protect against credential stuffing or any other type of attack.
Packetlabs is a great resource for companies who want to learn more about credential stuffing or other types of attacks. Their team of experts can help you find the vulnerabilities in your systems and networks so you can fix them before an attack happens.