Credential Stuffing 😈🐝

Photo by Max van den Oetelaar on Unsplash

Credential stuffing is a brute-force attack on a services’ user accounts. Not one specific account, but many. Typically by using credentials that were found in other hacks. As a user, you can see via haveibeenpawned.com if one of your accounts was compromised. Most likely, it was. Let’s learn what you can do!

Why you should care

Credential Stuffing is part of “Broken Authentication” and thus #2 in the OWASP Top 10 (source)
2020: $3.5 million in fraudulent check withdrawals with credential stuffing (more details)
2020: About 500,000 Zoom users credentials were found with credential stuffing (source)
2020: “Retail, travel, and hospitality industries attracted a startling 63% of credential stuffing attacks” according to Akamai.
2021: AVM (FritzBox) registers a lot of credential stuffing attacks (source)

How does a credential stuffing attack work?

The attacker gets a list of valid credentials, e.g. (username, password) for millions of people. There are many leaks.
The attacker tries them on big services (Gmail, Facebook, Twitter, Banks, Reddit, …)

That’s it. It’s really trivial. Credential stuffing does not target you personally, but a lot of people at the same time. But that doesn’t help you when your bank account is empty at the end of the day, does it?

How can I defend against a credential stuffing attack?

As a user, there are two perfect defense measures:

Strong Passwords: Good passwords might look different than you think. But it’s easy to generate memorizable strong passwords.
Unique Passwords: Don’t share passwords among services. Never.

To fulfill both in a convenient way, you should use a password manager. A third point that helps is to use multi-factor authentication (MFA). Having at least a second factor (2FA) goes a long way. However, the attacker most likely learns which passwords are correct and can work on breaking the second factor, e.g. by SIM swapping.

As a service provider, the defenses are not perfect and more complicated:

Rate Limiting: If a single IP makes too many invalid password attempts, slow that IP down. For example, ask them to solve a CAPTCHA first. Or tell them that they are not allowed to log in for the next 30 seconds. Just be aware that this could also block valid users, e.g. at schools or other bigger open networks.
Web Application Firewalls (WAF): Full disclaimer here: I don’t have practical experience here. I’ve heard about “Proactive Bot Defense” which might be interesting for other attack scenarios as well. However, it certainly also has the issues to detect all attacks (False-Negatives) and to block only attacks (False-Positives).
Two-factor authentication (2FA): Forcing the user to use a second factor makes it a lot less likely that credential stuffing works, even if the user shared passwords with a vulnerable service and even when the password is weak.
Single-Sign-On (SSO): Letting another service handle the authentication side-steps all of those hassles. One variant which is well-known is “social login”. That is simply SSO by big social websites like Facebook, Twitter, Github, or LinkedIn.
Check users' passwords for breaches: haveibeenpawned allows you to check if credential combinations are in a breach.

There are also some specific points to make the life of bot-developers harder, e.g. requiring JavaScript, blocking headless browsers, or blocking traffic from AWS. Jarrod Overson has written a very nice article about this:

10 Tips To Stop Credential Stuffing Attacks 10 steps you should take before buying an anti-automation service (+ 1 bonus tip).jsoverson.medium.com

Why you should care

How does a credential stuffing attack work?

How can I defend against a credential stuffing attack?

More in this series