Sizing Up The Scourge of Credential-Stuffing

Minimalist · Jul 20, 2018

Last year, 2.3 billion credentials were stolen from 51 different organizations, including Ancestry.com, Imgur and Virgin America. Where do all those user names go?

In Shape Security’s second annual Credential Spill Report, it found that billions of stolen digital IDs are contributing to an epidemic of credential-stuffing and account-takeover fraud.

Credential-stuffing is a technique used by hackers to gain fraudulent access to an account. It uses automated scripts to try multiple username/password combos against a targeted website. Successful account compromises from credential-stuffing are typically tied to the fact many users reuse the same credentials on multiple accounts.

The potential losses tied to credential spills is $50 million a day globally, and it takes an average of 15 months for a credential breach to be reported.
Click to expand...

https://threatpost.com/threatlist-sizing-up-the-scourge-of-credential-stuffing

guest · Sep 14, 2018

Operator at kayo.moe found a 42M Record Credential Stuffing Data ready to use
September 14, 2018
https://securityaffairs.co/wordpress/76195/hacking/credential-stuffing-data.html

A huge archive containing email addresses, plain text passwords, and partial credit card data has been found on a free anonymous hosting service, Kayo.moe.

The operator of the service shared the file with the popular expert Troy Hunt who operates the Have I Been Pwned data breach notification service asking him to check the source of the huge trove of data.
The database shared by Kayo includes over a total of 755 files totaling 1.8GB.

To avoid being vulnerable to credential stuffing attacks the best defense is to use different credentials for each web service we use. Don’t reuse passwords!
Click to expand...

guest · Sep 19, 2018

Credential Stuffing Attacks Generate Billions of Login Attempts
September 19, 2018
https://www.bleepingcomputer.com/ne...-attacks-generate-billions-of-login-attempts/

Credential stuffing attacks are a growing problem, particularly in the financial sector, where botnets can initiate so many fraudulent login attempts that the wave has the effect of a distributed denial-of-service (DDoS) attack.
Billions of malicious login attempts recorded
General statistics from one company that offers DDoS mitigation services are staggering: over 30 billion malicious login attempts recorded in less than one year, from November 2017 to June 2018.

The latest State of the Internet report from Akamai describes credential stuffing attacks targeting two companies in the financial sector, with one of them hit by three botnets at the same time.
Three botnets with different attack approaches
"Over three days, the botnet averaged 59 requests per second and was responsible for 190,487 malicious login attempts," Akamai writes in the report.

Credential stuffing attacks are easy to orchestrate due to automated tools available as a service. The main requirement is to have a large enough database of usernames and cracked passwords to feed into the login fields of various services.
Click to expand...

guest · Nov 29, 2018

Hackers Breach Dunkin’ Donuts Accounts in Credential Stuffing Attack
November 29, 2018
https://threatpost.com/hackers-breach-dunkin-donuts-accounts-in-credential-stuffing-attack/139472/

A credential stuffing attack has allowed hackers to take a big bite out of Dunkin’ Donuts customer data. The donut giant announced Tuesday evening that a data breach in October may have led to customers’ personal information being compromised.

Dunkin’ Brands Inc. in an advisory posted to its website said that on Oct. 31, a malicious actor attempted to access customers’ first and last names, email address, as well as account information for DD Perks, Dunkin Donuts’ rewards program.
Dunkin’ Donuts said its security vendor was successful in stopping most of these attempts, but it is possible still that the hacker may have succeeded in logging in to some DD Perks accounts.

“Having customers change their passwords is a temporary fix, a band-aid that doesn’t get to the root of the problem,” he said. “One effective way to stop this type of attack is to implement security solutions that detect this sophisticated automated activity at login and other placements. [...]"
Click to expand...

guest · Dec 22, 2018

Credential stuffing attack focuses on glasses retailer Warby Parker
December 21, 2018
https://www.scmagazine.com/home/sec...ack-focuses-on-glasses-retailer-warby-parker/

Warby Parker on Thursday disclosed that roughly 198,000 of its customers may have been affected by a credential stuffing attack targeting the eyeglass retail chain.

According to a company press release, an unknown cybercriminal actor has been attempting to access Warby Parker customer accounts by leveraging usernames and passwords that were previously stolen from other companies in unrelated breaches.
The perpetrators also potentially could have placed an order if customers had their payment card information stored. However, Warby Parker said there is no evidence that any payment card information was stolen.
Click to expand...

guest · Jan 27, 2019

DailyMotion discloses credential stuffing attack
DailyMotion falls to credential stuffing attack two weeks after Reddit had the same faith
January 27, 2019
https://www.zdnet.com/article/dailymotion-discloses-credential-stuffing-attack/

According to an email sent out to impacted customers, and seen by ZDNet, the credential stuffing started last weekend, on January 19, and appears to have been successful in some cases, with hackers gaining access to a limited number of accounts.

The company said its security team discovered the attack and it took "all necessary steps" to block it. Since last Saturday, the company has been logging off users who it believes were impacted and resetting their passwords.
The email sent to all affected customers contains a link for users to reset their password and regain control of their account.

The French company has also notified CNIL (Commission nationale de l'informatique et des libertés), France's data privacy watchdog, as demanded by Europe's new GDPR legislation.
Click to expand...

guest · Feb 1, 2019

Basecamp Fights Off Mass Login Attempt With Quick Cyber Response
February 1, 2019
https://www.cbronline.com/news/basecamp-fights-off-mass-login

Chicago-based web application developers Basecamp successfully mitigated a mass-login attempted on their network by attackers using stolen email and password information.

Threat actors instigated a credit stuffing attack against Basecamp’s website, which over the course of an hour experienced more than 30,000 login attempts. The IP addresses associated with the malicious access attempts came from a wide array of global locations.
In the aftermath of the attack Campbases ran a diagnostic and found that only 124 accounts had been accessed by unauthorised users.

Writing in a blog about the cyber incident Basecamp CTO David Heinemeier Hansso detailed their response stating that once the attack was over: “We immediately reset the password for these accounts, logging out any intruders, and emailed the affected account holders with all the relevant information.”
Click to expand...

guest · Feb 11, 2019

mood said: ↑

Hackers Breach Dunkin’ Donuts Accounts in Credential Stuffing Attack
November 29, 2018
https://threatpost.com/hackers-breach-dunkin-donuts-accounts-in-credential-stuffing-attack/139472/
Click to expand...

Dunkin' Donuts accounts compromised in second credential stuffing attack in three months
Hacked Dunkin' Donuts accounts are now being sold on Dark Web forums
February 12, 2019
https://www.zdnet.com/article/dunki...d-credential-stuffing-attack-in-three-months/

Dunkin' Donuts announced today that it was the victim of a credential stuffing attack during which hackers gained access to customer accounts.
This marks the second time in three months that the coffee shop chain notifies users of account breaches following credential stuffing attacks.

But hackers weren't after users' personal information stored in Dunkin' Donuts rewards accounts. Instead, they were after the account itself, which they are selling on Dark Web forums, according to a screenshot shared with ZDNet by threat intel firm Lastline.
[...] put up the hacked accounts for sale, which are later bought by other persons that use the reward points found in these accounts at Dunkin' Donuts shops to receive unearned discounts and free beverages.
Click to expand...

guest · Feb 22, 2019

Tax Returns Exposed in TurboTax Credential Stuffing Attacks
February 22, 2019
https://www.bleepingcomputer.com/ne...osed-in-turbotax-credential-stuffing-attacks/

Financial software company Intuit discovered that tax return info was accessed by an unauthorized party after an undisclosed number of TurboTax tax preparation software accounts were breached in a credential stuffing attack.

In the notice of data breach sent to the TurboTax users impacted by this security breach incident, Intuit says that: [...]
Intuit also states that the breach was discovered during a security review of its systems in the TurboTax data breach notification which was filed with the Office of the Vermont Attorney General.

Following the discovery of the security breach, Intuit decided to temporarily disable the TurboTax accounts which were breached in the credential stuffing attack.
Click to expand...

ronjor · Feb 25, 2019

TurboTax Hack: Intuit Says There Was No Data Breach, Users Are Not at Risk

By Nina Godlewski On 2/25/19
The post claiming that the company had suffered a breach was published on the website Dark Reading, and cited a disclosure letter that was filed in Vermont. That letter, while it was filed, was actually notifying the state of Vermont that a user profile had been accessed, not due to a breach, but instead with the user's actual credentials. "The individual’s account login information may have been acquired from any number of sources outside of Intuit," said Intuit on Monday.
Click to expand...

guest · Feb 27, 2019

Retailers have become the top target for credential stuffing attacks
February 27, 2019
https://www.zdnet.com/article/retailers-have-become-the-top-target-for-credential-stuffing-attacks/

Retailers are now the favorite target of cybercriminals looking to cash in through easy, automated credential stuffing attacks.

According to Akamai's 2019 State of the Internet report, released on Wednesday, the retail sector was the top target for credential stuffing techniques in the second half of 2018.
Akamai says that AIO bots, which are capable of deploying multi-functional tools including credential stuffers, have found particular value to criminals when it comes to product purchases.

Clothing websites are most often targeted, followed by department stores, office merchandise suppliers, and accessory retailers. In addition, the media, entertainment, and banking sectors are all common victims of these types of attacks.
"Retailers remain on the front lines because stolen merchandise sells quickly and at a premium. And for that reason, the data shows which merchandise is of the highest value: Apparel sites are targeted the most."
Click to expand...

Akamai: 2019 State of the Internet: Retail Attacks and API Traffic
(PDF - 11.0 MB): https://www.akamai.com/uk/en/multimedia/documents/state-of-the-internet/state-of-the-internet-security-retail-attacks-and-api-traffic-report-2019.pdf

guest · Apr 8, 2019

Credential stuffing attacks target media streaming services
April 8, 2019
https://betanews.com/2019/04/08/credentialstuffing-media-services/

The entertainment industry and in particular streaming services is among the biggest targets of credential stuffing attacks according to a new report.

The study from digital delivery platform Akamai, unveiled at the NAB Cybersecurity and Content Protection Summit in Las Vegas this week, focuses on credential abuse attacks against online video and music streaming services.
It reveals three of the largest credential stuffing attacks against streaming services in 2018, ranging in size from 133 million to 200 million attempts, took place shortly after reported data breaches, indicating hackers were likely testing stolen credentials before selling them.

"Hackers are very attracted to the high profile and value of online streaming services [...] The good news is that organizations are taking the threat seriously and investigating security defenses, as evidenced by the discussions at NAB. Akamai offers its research and best practices to help these organizations who are facing significant brand and financial harm."
Click to expand...

Akamai: Streaming Services Among The Most Targeted By Credential Stuffing Attacks According To Akamai Report
(PDF - 4.23 MB) https://www.akamai.com/uk/en/multimedia/documents/state-of-the-internet/soti-security-credential-stuffing-attacks-and-economies-report-2019.pdf

ronjor · Apr 23, 2019

How Nest, designed to keep intruders out of people’s homes, effectively allowed hackers to get in

By Washington Post PUBLISHED: April 23, 2019
The method used to spy on the Thomases is one of the oldest tricks on the Internet. Hackers essentially look for email addresses and passwords that have been dumped online after being stolen from one website or service and then check to see whether the same credentials work on another site. Like the vast majority of Internet users, the family used similar passwords on more than one account. While their Nest account had not been hacked, their password had essentially become public knowledge, thanks to countless other data breaches.
Click to expand...

guest · Apr 25, 2019

The Economy of Credential Stuffing Attacks
April 25, 2019
https://www.recordedfuture.com/credential-stuffing-attacks/

This report covers the current threat landscape of credential stuffing attacks. It reviews the most popular tools used by cybercriminals to initiate credential stuffing and describes some of the most popular marketplaces that sell compromised credentials.

This report contains information gathered using the Recorded FutureⓇ Platform, as well as additional open source, dark web, and underground forum research, and will be of most interest to analysts protecting e-commerce, telecommunications, and financial organizations from credential stuffing attacks, as well as those looking for investigative leads on threat actors performing such attacks.
Click to expand...

The Economy of Credential Stuffing Attacks (PDF - 4.22 MB): https://go.recordedfuture.com/hubfs/reports/cta-2019-0425.pdf

guest · Apr 30, 2019

After account hacks, Twitch streamers take security into their own hands
Twitch has an account hacking problem
April 30, 2019
https://techcrunch.com/2019/04/30/twitch-account-hacks/

[...] bots that cycle through password lists stolen from breached sites [...]
“Twitch knows it’s a problem — but this has been going on for months and there’s no end in sight,” Jakubowski told TechCrunch.
The Russia connection
In new research out Tuesday, Jakubowski and Xmas said Russian hackers are a likely culprit.
The researchers found attackers would run massive lists of stolen credentials against Twitch’s login systems using widely available automation tools. With no discernible system to prevent automated logins, the attackers can hack into Twitch accounts at speed.

Xmas said users “don’t realize” how vulnerable they are. “They don’t understand why their account — which they don’t even use to stream — is desirable to hackers,” he said. “If you have a payment card associated with your account, that’s what they want.”
Click to expand...

“Rewarding users for implementing two-factor would go a huge way,” said Xmas. “It’s incredible to see how effective that is.”
Jakubowski said until Twitch acts, streamers can do their part by encouraging their viewers to switch on the security feature. “Streamers are influencers — more users are likely to switch on two-factor if they hear it from a streamer,” he said.
Click to expand...

guest · Apr 30, 2019

Credential Stuffing Costs Firms $4m Each Year
April 30, 2019
https://www.infosecurity-magazine.com/news/credential-stuffing-costs-firms-4m/

Credential stuffing attacks are costing EMEA businesses on average $4m each year, according to new research from Akamai.
It found that companies are experiencing an average of 11 credential stuffing attempts each month, with each attack targeting 1041 user accounts.

Akamai calculated the $4m cost based on the financial impact of these attacks on application downtime ($1.2m), loss of customers ($1.6m), and the extra involvement of IT security ($1.2m) as well as the cost of follow-on fraud.

Complexity appears to be hampering efforts to contain credential stuffing. Surveyed companies had an average of 26.5 operational customer-facing websites for cyber-criminals to target via automated bot attacks.
Even more account takeover opportunities are presented by multiple log-in types across desktops, mobile web browsers, third-parties and mobile app users, it claimed.
Click to expand...

Minimalist · May 4, 2019

What is credential stuffing, and why is my smart security camera vulnerable to it?

Unfortunately, this experience is not unique. Hackers hoping to exploit weak security features will try to open the metaphoric doors of consumer products like security cams every chance they can. Also, a technique called “credential stuffing” has evolved into an effortless hack for even a novice cybercriminal.
Click to expand...

https://blog.avast.com/credential-stuffing-and-web-cams

guest · May 14, 2019

Hackers access data from more than 460,000 accounts at Uniqlo’s online store
May 14, 2019
https://www.cnbc.com/2019/05/14/jap...-access-data-from-460000-online-accounts.html

Fast Retailing, the Japanese company behind the Uniqlo retail chain, announced Monday that the data of more than 460,000 customers on its online shopping sites were accessed by hackers from April 23 to May 10.

In a statement released on its website, Fast Retailing said: “It was confirmed on May 10, 2019 that an unauthorized login by a third party other than the customer occurred on the online store site operated by our company,” according to a Google translation.
The breach gave hackers access to customers’ data including their names, addresses and contact details. The company acknowledged that partial credit card information “may have been browsed,” [...]

Investigations into the extent of the data hack continue.
Click to expand...

English version of the statement:
Unauthorized Logins on Fast Retailing Online Store Websites due to List Type Account Hacking and Request to Change Password

On May 10, 2019, Fast Retailing became aware of unauthorized logins to customer accounts on its official UNIQLO Japan and GU Japan online stores by third parties.
At present, Fast Retailing has determined that a total of 461,091 unauthorized logins occurred between April 23 and May 10, 2019, by means of list type account hacking

The method used for these unauthorized logins, similar to other recent incidents involving internet services, is assumed to be list type account hacking. Accordingly, it's likely that the accounts affected by unauthorized logins are those for which the user has registered the same password with other services. [...]
Click to expand...

Minimalist · Jun 13, 2019

Gaming industry has become popular target of credential stuffing attacks: study

A company’s recent analysis of credential abuse activity over a 17-month period uncovered roughly 55 billion credential stuffing attack attempts against various online services, roughly 12 billion of which targeted the gaming industry.

Researchers at Akamai Technologies revealed the data in their latest State of the Internet/Security report, which specifically focuses on web attacks and gaming abuse.
Click to expand...

https://www.scmagazine.com/home/sec...-target-of-credential-stuffing-attacks-study/

guest · Jun 22, 2019

TripAdvisor Invalidates Member Passwords Found in Data Breaches
June 22, 2019
https://www.bleepingcomputer.com/ne...ates-member-passwords-found-in-data-breaches/

With credential stuffing attacks running rampant, TripAdvisor will invalidate a member's password if their email and password were found in publicly leaked data breach databases.

A friend received an email from TripAdvisor.com yesterday and was concerned that it was a phishing email because it stated their email address and password were found in a "lists of publicly leaked passwords". Due to that, the company invalidated their password and they would need to reset it before they can login again.
TripAdvisor is doing this to prevent a member's account from being compromised using credential stuffing attacks.

The email TripAdvisor sends out when it encounters one of their members using the same credentials that were found in a leaked data breach or leak, can can be read in its entirety below:
Click to expand...

Dear TripAdvisor Traveler,

As part of our ongoing efforts to protect your security, TripAdvisor recently compared our member databases with lists of publicly leaked passwords. Unfortunately, your email and password were included on a list of leaked passwords. As a result, to protect your TripAdvisor account we have invalidated your password.

We recommend that you create a strong password that includes:

* A unique combination of words, numbers, symbols, and both upper- and lower-case letters
* A minimum of eight (8) characters
* No commonly used words

Please visit the following page to create a new password for your account:

https://www.tripadvisor.com/MemberForgotPassword

In addition, we recommend that you take additional steps for the safety of your other online accounts. If your discontinued TripAdvisor password is used on any other site or app, change your password on those sites/apps — and avoid using any password on more than one site.

Thank you for being a valued part of our community, and for taking a moment to create a new password. If you have questions about any of this information, please contact us at loginsupport@tripadvisorsupport.com

Best Regards,
The TripAdvisor Team

guest · Jul 24, 2019

Deliveroo Accounts Are Being Hacked And Sold For Just $6
July 24, 2019
https://www.forbes.com/sites/thomas...nts-hacked-and-sold-on-dark-web/#4fdbfd342ff5

If you've had your Deliveroo account hacked in recent months, it may be that the thief bought your password from a dark web dealer for as little as $6.
Or the crooks could've used what's known as "credential stuffing." This is where hackers gather up leaked passwords from previous mega-hacks and try reusing them on any account they can.

Victims are witnessing bizarre food and booze orders illicitly made under their name, with some orders totalling $560 (£450). One such unfortunate was Tessa Bryant, a PR manager at London-based startup investment company Seedrs.
It would appear in her case the hackers had acquired a password from a previous breach and tried to reuse the login and subtle variations of it across various sites; she said that her Snapchat and Netflix accounts had also been hacked.

Forbes has learned of a significant number of Deliveroo account thefts in recent months, in particular across London. Two Forbes staff members were hit in the last two months. Bryant said a few others in her office had also seen their Deliveroo compromised.
Click to expand...

"Sadly cyber criminals rely on the fact that people reuse the same passwords on multiple online services and use data breaches on other sites to try gain access to Deliveroo accounts. There has been no breach of Deliveroo’s internal systems."
Click to expand...

guest · Jul 26, 2019

Gamers Are Easy Prey for Credential Thieves
July 26, 2019
https://threatpost.com/gamers-are-easy-prey-for-credential-thieves/146700/

Gamers are soft targets for credential-thieving hackers who see them as young, naive and playing it fast and loose with security.

“A 14-year-old kid’s gaming credentials are worth more than you think,” said Mike Wilson, CTO at Enzoic. He said credentials tied to Fortnite, Minecraft and RuneScape are particularly prime targets right now, earning a hacker as much as $40 per active username and password.
“These kids are more interested in the next challenge or high score, not their security,” he added in an interview with Threatpost.

Wilson doesn’t just place the blame on young gamers. He notes the gaming companies themselves, fan forums and grassroots gaming sites are huge contributing factors as well.
Popular gaming communities built on DIY platforms such as vBulletin, IPBoard, MyBB, PHPBB and PunBB are often ripe for SQL injection attacks, for instance. “A lot of these sites are running outdated software and and are poorly maintained. Nearly any have the latest patches,” Wilson said.
Click to expand...

guest · Jul 27, 2019

DNForum Sends Out Password Reset
July 26, 2019
https://domaininvesting.com/dnforum-sends-out-password-reset/

Earlier this morning, I unexpectedly received a password reset request at DNForum.
As a result, I was taken aback that a password reset email was sent to me. It looks like I was not alone in receiving the reset notification, as others have mentioned receiving the same password reset email.

When I visited DNForum this morning, I saw a message on the home page alerting visitors to the automated password reset request that was sent to users. Here are the two notes currently on the homepage of DNF:

“Dear DNForum.com user. We have been forced to alter your password in order to maintain your account security. This process can take up to 24 hours.
There have been attempts to access accounts that are from 2014 or older and therefore we have seen it necessary to do a hard reset of all user passwords. [...]"
It is always a good idea to ensure your passwords are not repeated on multiple websites. If they are repeated, if one site gets hacked someone could gain access to other websites that use the same username / email and password combination.
Click to expand...

Minimalist · Jul 30, 2019

Crooks Sell Credentials Using Combolists-as-a-Service Model

Cybercriminals are now using a combolists-as-a-service model to sell credential collections to other crooks, which will later use them as part of large scale malicious account takeover attacks targetting both individuals and organizations.
Click to expand...

https://www.bleepingcomputer.com/ne...dentials-using-combolists-as-a-service-model/

Minimalist · Aug 2, 2019

Cyber criminals launched 3.5 billion malicious login attempts in just 18 months - Akamai

Cyber crooks launched around 3.5 billion credential stuffing attempts during the 18-month period from November 2017 to April 2019 - with the financial sector targeted in particular.
Click to expand...

https://www.computing.co.uk/ctg/news/3079911/financial-sector-cyber-crime

Log in or Sign up

Sizing Up The Scourge of Credential-Stuffing

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Log in or Sign up

Sizing Up The Scourge of Credential-Stuffing

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Useful Searches