What is Credential Stuffing – How Hackers Attempt Unauthorized Logins

June 25, 2020 By Nick Anderson No Comments 5 minutes

TheYour online credentials are the most important information that enables you to access various services. Credentials verify ownership. It is your key to the online platforms that you have signed up for. Due to being extremely sensitive, this information is valuable to hackers. Learn how hackers use Credential Stuffing to gain access to your accounts and how to prevent it.

Credential Stuffing Explained

Hacking is a practice of gaining unauthorized access to a system to carry out an action nefarious in nature. You must have heard of breaches in services that make headlines in the tech space now and then. It’s not uncommon to see reports regarding the theft of millions of accounts it not uncommon.  The primary purpose of attacking a service is to extract the database that contains the login information of users.
Even foiled attempts can take at least some data. Usually, when a service is affected by a breach, it rolls out a press release informing the public of the incident. It also emails registered users to change their credentials immediately because such breaches take at least a portion of the database with them before they are detected, and security defenses kick them out.
But resetting the password of that particular account shouldn’t be the only thing you do.
Once a cyberattack has stolen credentials of users, they will be up for sale to anyone willing to pay for it, in the Dark Web. The Dark Web is the place where all sorts of illegal activities take place. You can learn about The Dark web on our blog. This underbelly of the internet is where stolen data goes up for sale.
As we mentioned, resetting the password of that one account will not completely protect you from authorized access. Users tend to use one password across multiple services. It is where Credential Stuffing comes in to hack its way into other accounts.
Once a hacker obtains credentials, it will run a trial and error sort of experiment on other services to see if the password matches. Of course, manually inserting the list of users and their credentials on various other websites will be significantly time consuming, so hackers delegate this job to bots.

Websites place CAPTCHA (Completely Automated Public Turing) during login to deter mass login attempts.
But even with restrictions such as timeouts and IP ban in place, Credential Stuffing can be successful. The tools that bypass these restrictions jump login attempts between multiple IP addresses. So the hackers can keep attempting passwords without being locked out.

The real danger is when credit card information gets leaked online, not just the credentials of social media platforms.
One example of a cyberattack is Yahoo. The internet service company revealed that a breach in 2013 compromised the information of 3 billion users, making it the biggest data breach in history.

Credential Stuffing is Not Brute Force

Credential Stuffing may appear to be a Brute Force technique, but that’s not correct. Brute Force is a technique that applies randomly generated passwords to an account until it finds the right combination. The difference from Credential Stuffing here is dealing with the unknown – there’s no indication or information on the account’s credentials. Brute Forcing is much more time consuming and requires significantly more computing resources. Computing capability directly affects the efficiency of Brute Forcing.
Credential Stuffing simply takes the known credentials and starts applying them to other services. It’s like having a key and hoping there’s another lock that accepts it.

How to Defend Against Credential Stuffing

There is not much you can do once a service has been breached. It’s entirely up to the service’s capability to keep your data safe.
Remember that generating a strong password only secures you against Brute Force. Passwords that include uppercase and lowercase letters, special characters, and numbers, make up for a powerful combination.
However, the one thing you can do – and should do – is keep different passwords across all your accounts. It is challenging to remember multiple passwords that have a unique combination, so using a password manager will come in handy. If the password manager offers a web browser extension, then it will automatically fill in credentials for you at login.
In addition to strong and unique passwords, enable two-factor authentication (2FA). The feature is a strong defense against unauthorized logins and adds a second layer of verification. Although it requires you to have an active number with you at all times, the benefits far outweigh the hassle. After the first two-factor authentication, you can choose to allow future logins from the same device or keep the 2FA for each login.
Some services will inform you if there was a login attempt from an unfamiliar device.
But a security breach isn’t the only way hackers gain access to credentials. Weak security over the internet can allow hackers to intercept data packets. The prominent example is how public Wi-Fi hotspots can be used to carry out a Man-in-the-Middle attack. Unsecure networks or an unsecured connection between the website and the user has the potential to give hackers a chance.
Most websites today use HTTPS to secure internet communication with encryption. However, a VPN makes every outbound traffic encrypted, including for websites that only use HTTP. FastestVPN’s military-grade encryption will ensure security when browsing through unsecured networks on the go.

Conclusion

With all that said, the outlook is not as troubling as it sounds. It’s estimated that less than 0.5% of Credential Stuffing attempts are successful. But that should not prevent you from taking precautions. Never use a password on more than one website; that’s the rule you must follow.

Subscribe to Newsletter

Receive the trending posts of the week and the latest announcements from FastestVPN via our email newsletter.

Email Address