Credential stuffing

Description

Credential stuffing is the automated injection of breached username/password pairs in order to fraudulently gain access to user accounts. This is a kind of brute force attack: large numbers of spilled credentials are automatically entered into websites until they are potentially matched to an existing account, which the attacker can then hijack for their own purposes. Credential stuffing is one of the most common techniques used to take-over user accounts.

Anatomy of Attack

1. The attacker acquires spilled usernames and passwords from a website breach or password dump site.
2. The attacker uses an account checker to test the stolen credentials against many websites (for instance, social media sites or online marketplaces).
3. Successful logins (usually 0.1-0.2% of the total login attempts) allow the attacker to take over the account matching the stolen credentials.
4. The attacker drains stolen accounts of stored value, credit card numbers, and other personally identifiable information
5. The attacker may also use account information going forward for other nefarious purposes (for example, to send spam or create further transactions)

Risk Factors

TBD

Examples

Below are excerpts taken from publications analyzing these large-scale breaches. There is evidence to support that these breaches were connected by credential stuffing.

• Sony, 2012: “I wish to highlight that two-thirds of users whose data were in both the Sony data set and the Gawker breach earlier this year used the same password for each system.”
  • Source: Agile Bits [1]
  • Source: Wired [2]

• Yahoo, 2013: “What do Sony and Yahoo! have in common? Passwords!”.
  • Source: Troy Hunt. [3]

• Dropbox, 2013: “The usernames and passwords referenced in these articles were stolen from unrelated services, not Dropbox. Attackers then used these stolen credentials to try to log in to sites across the internet, including Dropbox”.
  • Source: Dropbox. [4]

• JPMC, 2014: “[The breached data] contained some of the combinations of passwords and email addresses used by race participants who had registered on the Corporate Challenge website, an online platform for a series of annual charitable races that JPMorgan sponsors in major cities and that is run by an outside vendor. The races are open to bank employees and employees of other corporations”.
  • Source: NY Times. [5]

This connected chain of events from Sony to Yahoo to Dropbox excludes JPMC. The JPMC breach came from a separate and unrelated source. We know that the JPMC breach was caused by attackers targeting an unrelated third-party athletic race/run site for credentials to use against JPMC.