A recent Shape Security report titled “2017 Credential Spill Report” takes a hard look at the potential for cybercriminals to misuse personal credentials spilled from major data breaches in the past year.

According to the report, 3.3 billion user credentials spilled onto the internet in 2016. Fraudsters can use these credentials to gain access to accounts on other websites, banking on users’ tendency to recycle login information in what’s called a credential-stuffing scheme.

The report revealed that cybercriminals made over 5 million login attempts in one week at a Fortune 100 B2C website through the use of multiple attack groups and hundreds of thousands of proxies around the world. One large retailer, in fact, witnessed over 10,000 login attempts using over 1,000 proxies in a single day.

Recycled Passwords Enable Credential-Stuffing Fraudsters

Many users have fallen into the bad habit of reusing passwords and IDs on multiple sites. This behavior facilitates the type of attack described above. On most websites, users enter their email addresses in lieu of user IDs, so cybercriminals often need only to crack a victim’s password once to gain entry to several of his or her accounts.

SecurityWeek noted that some breaches are extant for years before they are finally disclosed. Since passwords are only protected by the relatively weak MD5 algorithm, attackers have ample time to decode them. Once that happens, the credentials can be sold on the Dark Web or otherwise forwarded to fraudsters.

Confounding CAPTCHA

Websites typically use CAPTCHA and other techniques to prevent multiple login attempts from the same IP address. Credential-stuffing schemes rely on various methods to get around these defenses.

Fraudsters can use captive botnets to make it seem like multiple login attempts are coming from different IP addresses. Security tools have a hard time choosing one IP address to identify as potentially malicious. Even if an IP is flagged, the automated tool will have moved on to another, which limits the effectiveness of blocking IP addresses.

The report identified Sentry MBA as the most common tool used for this purpose. According to the report, the software “uses ‘config’ files for target websites that contain all the login sequence logic needed to automate login attempts.”

There are enough spilled credentials out there to make credential stuffing a profitable endeavor for fraudsters. Users should choose different login credentials for each of their accounts to mitigate this threat.