Battling the new breed of account takeover (ATO) fraud

guest · Oct 1, 2021

How to Prevent Account Takeovers in 2021
September 28, 2021
https://threatpost.com/protect-account-takeover-cyberattacks/175090/

Data breaches and hacking put internet users at risk of account takeover, if cybercriminals successfully gain access to valid login credentials. There are reckoned to be in excess of 8.4 million discrete passwords currently circulating online, more than 3.5 billion of which are tied to active email addresses.

Every data breach that exposes usernames and passwords creates more assets to be sold on the Dark Web, and used in scripts to fuel credential-stuffing activities.
Click to expand...

Unfortunately, many people still tend to reuse their passwords and security-verification questions across a range of websites. So using credentials exposed by a data breach, cybercriminals can enjoy a higher success rate and reduced effort in their attempts to gain access to existing accounts.

To assist them, an entire underground economy has emerged, selling specialist tools and stolen personal data to fuel automated credential-stuffing campaigns. Automated bots and scripts are popular with perpetrators of online fraud, as the automation enables them to maximize their investment returns and achieve wider coverage in their account takeover attempts. Sophisticated bots are capable of bypassing many fraud prevention solutions.
Click to expand...

Likewise, hacker intervention can occasionally circumvent standard authentication measures for blocking account takeover fraud.
6 Measures to Deal with Account Takeover
There’s no single “magic bullet” to remedy the issues of credential stuffing and account takeover. Rather, the solution must come from a judicious mix of techniques and cybersecurity best practices. Here’s a rundown of what to consider:
1. Attack Detection [...] / 2. Two-Factor Authentication (2FA) [...] / 3. Monitoring Public Data Dumps [...]
4. Enhanced Password Policies [...] / 5. App Authentication [...] / 6. Zero-Trust Security [...]
Click to expand...

Credential-stuffing attacks, utilizing user names/passwords extracted from unconnected data breaches, are one of the most common account takeover mechanisms.

Adding a requirement for appropriate and independently verified additional factors (eg 2FA, biometrics, app authentication) to gain access to your servers will make your business dramatically less likely to suffer account takeover attacks.
Click to expand...

guest · Oct 1, 2021

Innovative Proxy Phantom ATO Fraud Ring Haunts eCommerce Accounts
...rate of nearly 2,700 login attempts per minute with new techniques that push the ATO envelope.
September 30, 2021
https://threatpost.com/proxy-phantom-fraud-ecommerce-accounts/175241/

A sophisticated fraud ring, dubbed Proxy Phantom, has pushed the boundaries of credential-stuffing attacks with a dynamic account takeover (ATO) technique that was flooding eCommerce merchants in the third quarter.

Researchers at Sift uncovered the group, which is innovating in the realm of large-scale, automated ATO attacks, they said. Specifically, Proxy Phantom specializes in using a massive cluster of connected, rotating IP addresses to automatically try more than 1.5 million stolen username and password combinations against various log-in screens. The third-quarter attacks affected dozens of online merchants, but the next targets could be in any number of sectors.

“The group flooded businesses with bot-based login attempts to conduct as many as 2,691 log-in attempts per second—all coming from seemingly different locations,” the researchers explained in a Thursday analysis.
Click to expand...

The username/password combos were likely purchased in bulk on the Dark Web, the report noted. Ongoing credential theft and the collation of multiple breaches into vast collections has made underground forums home to a wonderland of login offerings, fueling an ongoing ATO boom.

“While it’s inevitable that will grow over time, this specific one exploded in size,” according to Sift.
This is a remodel of typical ATO techniques that’s aimed at making a greater impact, researchers noted.

The fraud-detection evasion is particularly concerning, the analysis pointed out, because the sheer volume of login attempts could end up fogging security systems altogether.
Click to expand...

ATO Attacks See Staggering Uptick
“Fraudsters will never stop adapting their techniques to overwhelm traditional fraud prevention, making suspicious logins look legitimate, and legitimate ones look suspicious,” said Jane Lee, trust and safety architect at Sift, in a statement. “At the same time, poor consumer security habits—like reusing passwords for multiple accounts—make it easy and continue to breathe life into the fraud economy.”

The report also found that victims of ATO fraud are usually in for a long haul of misery. For instance, almost half (48 percent) of ATO victims have had their accounts compromised between two and five times.
Click to expand...

Sift: Q3 2021 Digital Trust & Safety Index: Battling the new breed of account takeover fraud

Fraudsters are determined to overwhelm merchant security measures for profit, and are leveraging increasingly sophisticated tools—like automation—to execute large-scale account takeover attacks at a cyclone pace. New data from Sift’s global network reveals that ATO fraud exploded by 307% between 2019-2021.

How a global fraud ring launched an international, automated ATO blitz attack against e-commerce merchants, with thousands of attempted logins per second

Changing account takeover fraud rates across different industries, with alarming trends emerging in fintech

Click to expand...

Log in or Sign up

Battling the new breed of account takeover (ATO) fraud

guest Guest

guest Guest

Log in or Sign up

Battling the new breed of account takeover (ATO) fraud

guest Guest

guest Guest

Useful Searches