API Security Webinar : Credential Stuffing
0 likes155 views
Credential stuffing involves using breached username and password pairs from one site to attempt to log in to other sites where users may have reused passwords. It occurs in four main steps: 1) obtaining credentials from data breaches, 2) automating the login process without human interaction, 3) defeating any login defenses, and 4) distributing the process globally through botnets and cloud hosting. While two-factor authentication prevents account takeovers, credential stuffing can still reveal valid user accounts. Users and organizations are encouraged to take steps like using unique passwords, password managers, and two-factor authentication to help mitigate credential stuffing risks.
API Security Webinar : Credential Stuffing
- 1. | ©2021 F5 NETWORKS 1 June 2021 Alexander Marcel Credential Stuffing
- 2. “Credential Stuffing is super effective because it takes advantage of human behavior where majority is using same password for multiple services” CREDENTIAL STUFFING cre.den.tial stuff.ing The replay of a breached username/password pairs across sites to find accounts where passwords have been reused.
- 3. | ©2021 F5 NETWORKS 3 Confidential / / Part of F5 Get Credentials Automate Login Distribute Globally Defeat Automation Defenses (if any) 1 2 3 CREDENTIAL STUFFING 4 cre.den.tial stuff.ing The replay of a breached username/password pairs across sites to find accounts where passwords have been reused. STEPS OF CREDENTIAL STUFFING
- 4. CREDENTIAL STUFFING Step 1 Get Credentials
- 5. CREDENTIAL STUFFING Step 2 Automate Login No user interaction No device or browser spoofing Poor device/browser spoofing Excellent device/browser spoofing
- 6. CREDENTIAL STUFFING Step 2 Automate Login * No programming skills required. Create script in visual constructor.
- 7. CREDENTIAL STUFFING Step 2 Automate Login
- 8. | ©2021 F5 NETWORKS 8 Confidential / / Part of F5 CREDENTIAL STUFFING Step 3 Defeat Defenses (if any)
- 9. CREDENTIAL STUFFING Step 3 Defeat Defenses (if any)
- 10. CREDENTIAL STUFFING Step 3 Defeat Defenses (if any)
- 11. CREDENTIAL STUFFING Step 3 Defeat Defenses (if any)
- 12. CREDENTIAL STUFFING Step 3 Defeat Defenses (if any) What about 2FA ? 2FA does not stop Credential Stuffing 2FA stops automated account takeovers. The point of credential stuffing is to find valid accounts. Credential stuffing, even with 2FA, still results in valid accounts.
- 13. CREDENTIAL STUFFING Step 3 Defeat Defenses (if any) How can attacker bypass 2FA ? 1. Social Engineering 2. Phising (RTPP) 3. Sim Swapping 4. etc.. 472618
- 14. CREDENTIAL STUFFING Step 4 Distribute Globally
- 15. | ©2021 F5 NETWORKS 15 Attack Kill Chain Stolen credentials Botnets,cloud hosting,proxies Loginbehavior simulationtools CAPTCHAsolving tools starting: $0 $2 per 1000 IPs $50 per site config $1.39 per 1000 Because resources are cheap and widely available, it can cost just $200 to takeover 1000 accounts via credential stuffing.
- 16. CREDENTIAL STUFFING Call To Action for All Users 1. haveibeenpwned.com 2. Make your passwords unique 3. Use password manager 4. Enable 2FA 5. Review your social media privacy setting and so on.. please check securitycheckli.st
- 17. CREDENTIAL STUFFING Call To Action for IT Security & Anti Fraud Team [email protected]
- 18. | ©2021 F5 NETWORKS 18 Thank You & Stay Healthy