Credential Stuffing Attack: What is and How it Works?

In every big data breach when hackers successfully enter into a large enterprise system, they can easily access the entire database of consumers and password combinations.

Few of these login details are then published to the world to see, such as the RockYou data breach in 2009, which was published more than 30 million records for worldwide viewing. Other times, this sensitive data (login credentials) was obtained not by hacking into the company’s systems, but by phishing attacks. Regardless of how the data is obtained.

What is Credential Stuffing?

Credential stuffing is when a hacker tries to obtain publicly available accounts and passwords and tries to use them to log on to other websites.

Trying to log into so many stolen credentials against other websites is best described as trying to cram them anywhere, so this hacker technique is the name.

How Does a Credential Stuffing Attack Work?

There are several popular tools for credential stuffing attacks, most of which are free to download. Sentry MBA, Vortex and Accountkiller are the most famous examples.

Any hacker can install one of these malicious tools and start trying to break into a new account with old credentials.

How Do I Protect Myself From Credential Stuffing?

We know that now each of us manages multiple online accounts. Fully enjoying the benefits of digital presence also means creating an account for so many portals.

In addition to your primary email and social media accounts, you will also be invited to create accounts for the following types of services:

1. Various loyalty programs in your offline store;
2. Online retail stores;
3. Online entertainment providers (think Netflix)
4. Data storage or compression tools;
5. Public agencies prompt you to log in before viewing the report;

Many online tools require registration to use them. If you consider it, you may have created more accounts than you originally thought, and have little access.

Studies have shown that the average home user has about 120 online accounts associated with the same email address, while the average business user processes about 191 accounts.

Obviously, no one can remember so many different passwords in the heart of the way we should if our account is as secure as possible.

1. Using a strong and secure password manager

Credential attacks depends up on the inevitable need to set the same password or similar password for multiple accounts before.

However, since the password manager is always around, you don’t really need to know so many different passwords.

2. Set a strong password and a unique password only for your online account

Although I am drowsy for this beautiful display of humanity, as an anthropologist, I must advise you not to do so for the sake of cybersecurity.

If you care about your online security, make sure you only set strong passwords and unique passwords that are hard for cybercriminals to break.

3. Browse your account and reset all passwords

Regularly resetting passwords is an important part of any network security health checklist.

Many well-known companies have internal security policies that force employees to change passwords every 6 months. They also need to avoid using work passwords in their personal accounts, but unfortunately some of them break the rule.

That’s why credential stuffing attacks are still a viable hacking technique. Reset all passwords in a regular digital cleanup. Be sure to use a different account for each account in case your server is hacked.

4. Enable two-factor or multi-factor authentication

2 factor authentication system may not be 100% secure, but it can make it harder for cybercriminals to hack into your digital account. Hackers have come up with creative ways to circumvent it.

But that doesn’t mean you shouldn’t add it as much as possible, because multi-layered security is still better than less. MFA (Multi-factor authentication) is always better, to enhance your security.

5. Using and Identity and access management system in organisation

When a user tries to access the system or data, he or she first declares his or her identity, usually by entering a user name in the system. The system then verify the claim of identity through the authentication process.

Authentication process may use basic techniques, like passwords, or rely on modern technologies such as biometrics and token-based authentication.

Effective CIAM solutions help organisations securely and efficiently access technical resources across these different systems.

6. Do not connect to a public WI-FI network and be careful

Public Wi-Fi networks are one of the biggest security risks to systems. If you use them to sign in to any account, you can almost certainly end your credentials sooner or later.

If you absolutely need to connect to one, always use the VPN solution and reroute traffic through it.

Credential Stuffing Attack: What is and How it Works? was originally published in HackerNoon.com on Medium, where people are continuing the conversation by highlighting and responding to this story.