Credential stuffing - Revision history

Dirk Wetter at 21:02, 9 November 2018

2018-11-09T21:02:52Z

Dirk Wetter: Defense option added

2018-11-09T21:02:34Z

Defense option added

Jmanico: /* Risk Factors */

2015-02-23T13:25:24Z

‎Risk Factors

Jmanico: cleanup...

2015-02-23T13:25:13Z

cleanup...

Neal Mueller at 14:04, 4 February 2015

2015-02-04T14:04:08Z

Neal Mueller at 21:31, 3 February 2015

2015-02-03T21:31:40Z

Neal Mueller: /* Anatomy of Attack */

2015-02-03T21:16:50Z

‎Anatomy of Attack

Neal Mueller: /* Related Vulnerabilities */

2015-02-03T21:16:12Z

‎Related Vulnerabilities

Neal Mueller: /* Related Controls */

2015-02-03T21:15:35Z

‎Related Controls

Neal Mueller: /* Related Threat Agents */

2015-02-03T21:14:35Z

‎Related Threat Agents

@@ Line 66: / Line 66: @@
 * [[Authentication]]
-== Defense ===
+== Defense ==
 * [[Credential Stuffing Prevention Cheat Sheet]]

@@ Line 65: / Line 65: @@
 == Related Controls ==
 * [[Authentication]]
 == References ==

← Older revision		Revision as of 13:25, 23 February 2015
Line 31:		Line 31:

	[1] http://michael-coates.blogspot.be/2013/11/how-third-party-password-breaches-put.html		[1] http://michael-coates.blogspot.be/2013/11/how-third-party-password-breaches-put.html
−
−	~~== Risk Factors ==~~
−
−	~~TBD~~
−

	== Examples ==		== Examples ==

@@ Line 4: / Line 4: @@
 == Description ==
-Credential stuffing is the automated injection of breached username/password pairs in order to fraudulently gain access to user accounts. This is a kind of brute force attack: large numbers of spilled credentials are automatically entered into websites until they are potentially matched to an existing account, which the attacker can then hijack for their own purposes.
+Credential stuffing is the automated injection of breached username/password pairs in order to fraudulently gain access to user accounts. This is a subset of the brute force attack category: large numbers of spilled credentials are automatically entered into websites until they are potentially matched to an existing account, which the attacker can then hijack for their own purposes.
 === Uniqueness ===
@@ Line 11: / Line 11: @@
 Credential stuffing is dangerous to both consumers and enterprises because of the ripple effects of these breaches. For more information on this please reference the Examples section showing the connected chain of events from one breach to another through credential stuffing.
 === Severity ===
@@ Line 26: / Line 25: @@
 === Diagram ===
 [[file:Credentialstuffing.png]]
-The above diagram was made by Michael Coates [https://www.owasp.org/index.php/User:MichaelCoates]
+=== References ===
 == Risk Factors ==

@@ Line 39: / Line 39: @@
 Below are excerpts taken from publications analyzing large-scale breaches.  Evidence supports that these breaches were the result of credential stuffing.
-*Sony, 2012: “I wish to highlight that two-thirds of users whose data were in both the Sony data set and the Gawker breach earlier this year used the same password for each system.”
+*Sony, 2011 breach: “I wish to highlight that two-thirds of users whose data were in both the Sony data set and the Gawker breach earlier this year used the same password for each system.”
 **Source: Agile Bits [https://blog.agilebits.com/2011/06/07/two-thirds-of-web-users-re-use-the-same-passwords/]
 **Source: Wired [http://www.wired.com/2011/10/93000-sony-accounts-breached/]
-*Yahoo, 2013: “What do Sony and Yahoo! have in common? Passwords!”.
+*Yahoo, 2012 breach: “What do Sony and Yahoo! have in common? Passwords!”.
 **Source: Troy Hunt. [http://www.troyhunt.com/2012/07/what-do-sony-and-yahoo-have-in-common.html]
-*Dropbox, 2013: “The usernames and passwords referenced in these articles were stolen from unrelated services, not Dropbox. Attackers then used these stolen credentials to try to log in to sites across the internet, including Dropbox”.
+*Dropbox, 2012 breach: “The usernames and passwords referenced in these articles were stolen from unrelated services, not Dropbox. Attackers then used these stolen credentials to try to log in to sites across the internet, including Dropbox”.
 **Source: Dropbox. [https://blog.dropbox.com/2014/10/dropbox-wasnt-hacked/]
-*JPMC, 2014: “[The breached data] contained some of the combinations of passwords and email addresses used by race participants who had registered on the Corporate Challenge website, an online platform for a series of annual charitable races that JPMorgan sponsors in major cities and that is run by an outside vendor. The races are open to bank employees and employees of other corporations”.
+*JPMC, 2014 breach: “[The breached data] contained some of the combinations of passwords and email addresses used by race participants who had registered on the Corporate Challenge website, an online platform for a series of annual charitable races that JPMorgan sponsors in major cities and that is run by an outside vendor. The races are open to bank employees and employees of other corporations”.
 **Source: NY Times. [http://dealbook.nytimes.com/2014/10/31/discovery-of-jpmorgan-cyberattack-aided-by-company-that-runs-race-website-for-bank/]

← Older revision		Revision as of 21:31, 3 February 2015
Line 5:		Line 5:

	Credential stuffing is the automated injection of breached username/password pairs in order to fraudulently gain access to user accounts. This is a kind of brute force attack: large numbers of spilled credentials are automatically entered into websites until they are potentially matched to an existing account, which the attacker can then hijack for their own purposes.		Credential stuffing is the automated injection of breached username/password pairs in order to fraudulently gain access to user accounts. This is a kind of brute force attack: large numbers of spilled credentials are automatically entered into websites until they are potentially matched to an existing account, which the attacker can then hijack for their own purposes.
		+
		+	=== Uniqueness ===
		+
		+	Credential stuffing is a new form of attack to accomplish account takeover through automated web injection. Credential stuffing is related to the breaching of databases; both accomplish account takeover. Credential stuffing is an emerging threat.
		+
		+	Credential stuffing is dangerous to both consumers and enterprises because of the ripple effects of these breaches. For more information on this please reference the Examples section showing the connected chain of events from one breach to another through credential stuffing.
		+

	=== Severity ===		=== Severity ===

← Older revision		Revision as of 21:16, 3 February 2015
Line 18:		Line 18:
	#The attacker may also use account information going forward for other nefarious purposes (for example, to send spam or create further transactions)		#The attacker may also use account information going forward for other nefarious purposes (for example, to send spam or create further transactions)

		+	=== Diagram ===
	[[file:Credentialstuffing.png]]		[[file:Credentialstuffing.png]]

← Older revision		Revision as of 21:16, 3 February 2015
Line 56:		Line 56:

	== Related Vulnerabilities ==		== Related Vulnerabilities ==
		+	* [[API Abuse]]

	== Related Controls ==		== Related Controls ==

← Older revision		Revision as of 21:15, 3 February 2015
Line 58:		Line 58:

	== Related Controls ==		== Related Controls ==
		+	* [[Authentication]]

	== References ==		== References ==

← Older revision		Revision as of 21:14, 3 February 2015
Line 49:		Line 49:

	== Related Threat Agents ==		== Related Threat Agents ==
		+	* [[:Category:Authentication]]

	== Related Attacks ==		== Related Attacks ==