Cyber Security Essay Sample: Credential Stuffing - Prevention

Credential stuffing is described as a cybercrime technique used by attackers through automated scripts to try the stolen credentials against the targeted website (Townsend, 2017). The main reason why this method work is because users use the same credentials in multiple accounts. Credential stuffing affects many organizations and they need to come up with mechanisms to prevents such activities from occurring or taking place.

Is your time best spent reading someone else’s essay? Get a 100% original essay FROM A CERTIFIED WRITER!

Order now

We've seen a recent increase in credential stuffing in recent times, with attacks varying from the blatantly obvious (1000s of requests in a minute, to the login page, from the same IP, with a scripting User Agent like python-requests) to highly distributed attacks across 100s of IPs with a random but current user-agent ("The Account Takeover Kill Chain - CardNotPresent.com", 2018). However, some malicious folk do this all manually and write their scripts, tools like those mentioned in Troy's post are pretty standard.

One mentioned that I'd like to call out is Sentry MBA - this tool is easily adapted to any business via a shareable config, written by anyway. Want to know if your service is probably affected or targeted? Google "Sentry MBA" + your businesses name (Glazier & Dhiman, 2017). There are trading forums for these configs, and they range from banks and big businesses to CRM and utility services ("OWASP Automated Threats to Web Applications - OWASP," 2018).

Sentry MBA also can share specific information on a successful login, helping to identify those key accounts that'll earn you more on the black market, such as recent successful orders on Amazon, or a high number of points on Starbucks accounts (Glazier & Dhiman, 2017). If you've got a business with an online login page, it's well worth checking the logs these types of attacks, to see if any of your users or even employees need to have their passwords reset after being successfully popped from a credential stuffing attack (Townsend, 2017). To combat credential stuffing and other types of rising attacks, organizations need data - and lots of it - to feed machine learning and artificial intelligence algorithms to detect these types of high volume attacks better, says Dan Woods, vice president of the Shape Intelligence Center.

The primary defense for credential stuffing is to make sure that an individual uses unique passwords for each website making sure that they are not compromised. It mainly allows validation of the first account setup on the real-time ensuring that the user logins are not compromised (Glazier & Dhiman, 2017). Other essential defenses against credential stuffing include device fingerprinting, IP blacklisting, multi-step login process, multi-factor authentication, and disallowing email addresses to be used a user IDs (Townsend, 2017). These steps make it hard for the attacker to gain confidential information as such information is not stored or used by the system.

Furthermore, the countermeasures that are recommended by OWASP includes unique passwords, the importance of protecting essential passwords recovery procedures, the guidance of the users on how to select unique and robust passwords (Glazier & Dhiman, 2017). The process of credential stuffing calls for an approach that is industry and organizationally based to ensure that the process takes all the process and steps necessary into account.

To sum up, credential stuffing is a technique used by hackers to try and enter stolen credential information on the targeted website. Business and organizations need to employ credential stuffing prevention mechanisms such as two-step verification, unique passwords, device fingerprinting, IP blacklisting, and disallowing email addresses to be used a user IDs.

References

Glazier, W., & Dhiman, M. (2017). Sentry MBA - A Peek into the Underground Economy (pp. 2-11). Stealth Security, Inc.

OWASP Automated Threats to Web Applications - OWASP. (2018). Retrieved from https://www.owasp.org/index.php/OWASP_Automated_Threats_to_Web_Applications

The Account Takeover Kill Chain - CardNotPresent.com. (2018). Retrieved from https://cardnotpresent.com/the-account-takeover-kill-chain/

Townsend, K. (2017). Credential Stuffing: a Successful and Growing Attack Methodology | SecurityWeek.Com. Retrieved from https://www.securityweek.com/credential-stuffing-successful-and-growing-attack-methodology