January 19, 2017 By Larry Loeb 2 min read

A recent Shape Security report titled “2017 Credential Spill Report” takes a hard look at the potential for cybercriminals to misuse personal credentials spilled from major data breaches in the past year.

According to the report, 3.3 billion user credentials spilled onto the internet in 2016. Fraudsters can use these credentials to gain access to accounts on other websites, banking on users’ tendency to recycle login information in what’s called a credential-stuffing scheme.

The report revealed that cybercriminals made over 5 million login attempts in one week at a Fortune 100 B2C website through the use of multiple attack groups and hundreds of thousands of proxies around the world. One large retailer, in fact, witnessed over 10,000 login attempts using over 1,000 proxies in a single day.

Recycled Passwords Enable Credential-Stuffing Fraudsters

Many users have fallen into the bad habit of reusing passwords and IDs on multiple sites. This behavior facilitates the type of attack described above. On most websites, users enter their email addresses in lieu of user IDs, so cybercriminals often need only to crack a victim’s password once to gain entry to several of his or her accounts.

SecurityWeek noted that some breaches are extant for years before they are finally disclosed. Since passwords are only protected by the relatively weak MD5 algorithm, attackers have ample time to decode them. Once that happens, the credentials can be sold on the Dark Web or otherwise forwarded to fraudsters.

Confounding CAPTCHA

Websites typically use CAPTCHA and other techniques to prevent multiple login attempts from the same IP address. Credential-stuffing schemes rely on various methods to get around these defenses.

Fraudsters can use captive botnets to make it seem like multiple login attempts are coming from different IP addresses. Security tools have a hard time choosing one IP address to identify as potentially malicious. Even if an IP is flagged, the automated tool will have moved on to another, which limits the effectiveness of blocking IP addresses.

The report identified Sentry MBA as the most common tool used for this purpose. According to the report, the software “uses ‘config’ files for target websites that contain all the login sequence logic needed to automate login attempts.”

There are enough spilled credentials out there to make credential stuffing a profitable endeavor for fraudsters. Users should choose different login credentials for each of their accounts to mitigate this threat.

More from

CISA hit by hackers, key systems taken offline

3 min read - The Cybersecurity and Infrastructure Security Agency (CISA) — responsible for cybersecurity and infrastructure protection across all levels of the United States government — has been hacked.“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson announced.In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed…

Cloud security evolution: Years of progress and challenges

7 min read - Over a decade since its advent, cloud computing continues to enable organizational agility through scalability, efficiency and resilience. As clients shift from early experiments to strategic workloads, persistent security gaps demand urgent attention even as providers expand infrastructure safeguards.The prevalence of cloud-native services has grown exponentially over the past decade, with cloud providers consistently introducing a multitude of new services at an impressive pace. Now, the contemporary cloud environment is not only larger but also more diverse. Unfortunately, that size…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today