The evolution in the cybersecurity threat landscape has been constant, and various actors need to be on top of these developments. It will help them ward off the malicious actors from harming their online infrastructure. A successful attempt by a cybercriminal can leave the reputation of an organization in shambles. This can make the customers lose trust in the organization or business. In this post, we will discuss a technique that, if successfully executed by a cybercriminal, can irreparably damage the institution financially and relation-wise with the customers, credential stuffing.
What is credential stuffing?
Before diving deep into how to detect and prevent credential stuffing attacks, let us first consider what credential stuffing is. Credential stuffing is a method through which a malicious actor steals or buys credentials and attempts to log into a user account using the said accounts. They use automated computer scripts called bots to perform many login attempts to a system using the credentials that the attacker may have bought, collected from another data breach, or stolen. Between 2019-2020, credential stuffing incidences almost doubled.
Though commonly confused with brute force attacks, the two are different. While in a brute force attack, a cybercriminal tries every combination of username and password, in credential stuffing, the attacker uses only the credentials they deem can easily give him access. Therefore, chances of success in credential stuffing are higher than in brute force attacks. Credential stuffing is usually a precursor to an account takeover attack. The primary aim of the cybercriminal is to validate the credentials that they have stolen or scraped from various websites and other breached sites.
How do you detect credential stuffing?
Below are the signs of a credential stuffing attack.
Having high volumes of foreign IPs
If there is high traffic of foreign IPs into your web server, the chances are that you have bots that are attempting various forms of attacks, among them credential stuffing. It would be best if you instituted measures to prevent them from validating the account credentials. There may be anomalies within the browser.
Increased number of failed login attempts
The other way to detect credential stuffing is through monitoring failed login attempts across multiple accounts. You can configure the tools to use a new IP address whenever an attacker attempts a set of credentials. There is a considerable variation in the number of different IPs that an attacker uses to launch an attack.
Analyzing the traffic for bot activity
The primary agent of credential stuffing is the bot. Therefore, it makes sense to analyse such traffic for the malicious actors. After their absence or presence is confirmed, various steps can prevent them from harming a website.
Analyzing login information
Through analyzing the login information, one can note the patterns. If there is an increase in the number of failed attempts to log in, that is usually a sign of a credential stuffing attack. In addition, monitoring the login information can tell you whether the user attempting to be authenticated is a bot or a real human user. You can also get the service they are trying to access, be it an API or a login portal.
Website service downtime
Have you encountered downtime on your website? The traffic that bots deliver to a website can lead to the site being offline. This is because they try thousands of pages per minute, exhausting your bandwidth.
Credential stuffing attacks usually happen after a significant data breach. It is because the attacker can get the credentials for free posted on various boards and websites. Having looked at how you can detect a credential stuffing attack, how can you prevent it?
How to prevent credential stuffing
Implementing multi-factor authentication
The best defense against credential stuffing and other attacks related to passwords is multi-factor authentication. Through an analysis conducted by Microsoft, multi-factor authentication can stop 99.9% of the attempts to compromise the accounts. Therefore, MFA should be implemented on a service wherever possible. The limitation of multi-factor authentication is that we cannot apply it to all audiences. To balance usability and security, you can combine multi-factor authentication with other techniques. Therefore, you require the second or third factor only in specific circumstances.
Setting up Risk-based authentication (RBA)
Based on a predefined set of rules, risk-based authentication can calculate the risk score. These may be any login-related issue like the reputation of an IP, identity details of a user, the users’ geolocation, data sensitivity, or a higher number of failed logins attempts than the preset one. Risk-based authentication comes in handy scenarios that are high risk. Hence, there is a need for customers to use password security that is customized.
Detecting bots
As seen above, the primary agent to carry out a credential stuffing attack are bots. Therefore, by detecting and stopping them, you can prevent credential stuffing from happening at all. One way of stopping them is through the use of CAPTCHA. Captcha solving can also be automated. Therefore, you can use other alternatives like recaptcha and honeypot captcha that can go a long way in stopping the bots which prevent credential stuffing.
Using password less authentication
Today, it is possible to be authenticated entirely without using your password. You can verify a user with something that they know or something they are. These can be another account or user biometrics, respectively. Organizations save the time and money invested in a password reset system while users have a better login experience through password-less authentication.
Limiting the number of authentication requests
In credential stuffing, many requests may originate from the same IP. Limit the authentication requests, and set up alerts for failed login attempts. A company can limit the authentication requests by devices, IP addresses, timeframes, or locations. It might not be very effective at stopping credential stuffing. Institutions like banks are strict on the number of failed logins attempts on an account. They freeze the account irrespective of the device or the IP address, and a user will have to visit a branch to reset their login credentials and get their accounts activated again.
Screen to see if there are any leaked credentials
A solution that automatically scans an extensive database of compromised credentials to see if user credentials are published is an effective way to prevent credential stuffing. If found, the company can alert the users to find their credentials in a leaked database of breached credentials. The user should then take measures to change the credentials before the attacker changes them.
Conclusion
Because credential stuffing is easy to perform, its popularity is on the rise. Cybercriminals use it to validate logins as a precursor for account takeover attacks. Your business may not have fallen victim yet, but taking up measures to prevent credential stuffing may save your brand and reputation in the future. Use the above mechanisms to detect and stop cybercriminals from using credential stuffing to attack your online infrastructure.
