Enzoic Navigation
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP
How Credential Stuffing Works

8 Ways to Mitigate Credential Stuffing Attacks

We all know that data breaches have leaked billions of user credentials (usernames and passwords) on the public internet and dark web. The Global Password Security Report shows an alarming 50% of people reuse the same passwords across their personal and work accounts. If a cybercriminal obtains legitimate credentials for a personal account, they often can also get into that person’s work account because of this password reuse. As a result, compromised credentials are a threat to many other sites, not just the organization that had the data breach. Organizations need to mitigate credential stuffing.

Once the user name and passwords combinations for users are exposed, cybercriminals can leverage that data in various ways. Here are the most common:

  • Access user accounts hosted on the site that was breached. This is known as account takeover, and the activity that a criminal can do within your account can include fraud and theft. 
  • Attack with a method called “credential stuffing” where cybercriminals can use a bot with a list of exposed credentials against a website to gain access to an account on that site. When the bots successfully access an account, it is logged, and they can either access the account themselves, or they can sell that data to criminals on the dark web.

There are various ways for organizations to mitigate a credential stuffing attack, but none are entirely 100% reliable in all cases. Here are the eight ways to mitigate credential stuffing

Here are the pros and cons of each method.

1) Use a password manager like LastPass. 

LastPass can be used for individual usage, or employees can use it within an organization. LastPass securely stores usernames and passwords, so users don’t have to remember them. They only need to remember one master password (which they should never use anywhere else). Now that users don’t have to remember their passwords, they can create random, strong passwords, and never reuse them. With over 13.5 million customers and 47,000 business enterprise clients, LastPass enables ease-of-use while maintaining high security when it comes to passwords.

However, there are use cases, particularly in D2C environments where the use of a password manager is not possible on a broad scale.

For example, an online retailer cannot force its customers to use a password manager to log in to their website. In these cases where a password manager cannot be used, we recommend a layered approach with the following options during user or customer authentication.

2) Implement possession-based 2FA or MFA.

This requires the user to successfully present at least pieces of evidence in the form of a certain possession, like a smartphone or USB key. It is secure, but the risk is that in customer environments, customers get annoyed by it and abandon usage. It also requires them to have those devices on hand, and not everyone uses the same technologies, so it is only a partial solution. According to Google, fewer than 10% of its users have signed up for two-factor authentication to protect their Google accounts.

3) Use knowledge-based 2FA or MFA on a device.

This requires the user to successfully present at least pieces of evidence in the form of knowledge, like a security question. The challenge is that sometimes, users cannot recall their answers, which generates additional help desk inquiries.

4) Screen for exposed credentials.

When your user logs in, a proper credential screening tool compares their credentials (both user name and password) against a database containing billions of compromised credentials. This process works quietly in the background and takes place in milliseconds. If the user’s password and user name pair have been compromised, organizations can decide what to do next—for example: force a password reset, deploy step-up authentication, hide sensitive data on the account, etc. 

“LastPass leverages Enzoic to screen billions of compromised credentials so that we can alert our users in the aftermath of a 3rd party data breach and put additional security measures in place. With this, we can help block account takeover attempts and other fraudulent activities.”

Sandor Palfy, CTO, LastPass by LogMeIn

5) Leverage adaptive authentication.

These systems cross-reference IP address, geolocation, device reputation, and other behaviors to assign a risk score to an inbound login session and step-up authentication factors accordingly. 

6) Add a biometric authentication option.

This is an interesting solution where the user’s fingerprint or face is used to authenticate. Users need to use a device that has biometric capabilities and many new devices include these biometrics features in the form of fingerprint readers or facial recognition. 

7) Use a captcha or something that requires a human response.

Captchas are program or system intended to distinguish human from machine input, typically as a way of thwarting spam and automated extraction of data from websites. Simple checkboxes tend to be okay for end users but requiring too much work from the end-user can cause frustration and abandonment. 

Overall, we found that captchas are often harder than they ought to be, with image captchas having an average solving time of 9.8 seconds… and audio captchas being much harder, with an average solving time of 28.4 seconds.

Stanford Captcha Study

8) Tracking traffic to your site.

There are also various technical ways to mitigate attacks like reviewing where your traffic is coming from, limiting traffic coming from Autonomous System Numbers (ASNs), blocking automated browsers that are frequently used by hackers, and tracking logins because if you have a lot of logins failures, that could be a sign of credential stuffing. 

While there is no single way to mitigate all credential stuffing attacks, applying a layered approach gives organizations the confidence that credential stuffing attack success is significantly reduced, without negatively impacting the user experience. 

About Enzoic

Enzoic is an enterprise-focused cybersecurity company committed to preventing account takeover and fraud through compromised credential detection. Organizations can use Account Takeover Prevention to screen user and customer accounts for exposed credentials or passwords. Enzoic for Active Directory allows organizations to screen employee accounts for exposed or bad passwords.

Enzoic (formerly PasswordPing) is a profitable, privately held company in Colorado. For more information, visit: www.enzoic.com

Credential Stuffing

Search

Assess your cyber vulnerabilities with a free password audit tool
Start Now

Browse blog categories

  • Account Takeover (28)
  • Active Directory (44)
  • all posts (153)
  • Continuous Password Protection (24)
  • COVID-19 (7)
  • Cracking Dictionaries (6)
  • Credential Screening (21)
  • Cybersecurity (66)
  • Data Breaches (31)
  • EdTech (3)
  • Enzoic News (18)
  • Financial Services Cybersecurity (5)
  • GovTech (4)
  • Healthcare Cybersecurity (15)
  • Law Firm Cybersecurity (2)
  • NIST 800-63 (28)
  • Password Security (30)
  • Password Tips (51)
  • Regulation and Compliance (11)

Stay up to date

Research, news, and more right to your inbox

More

  • Learning about strong, but unsafe passwords
  • What is a credential stuffing attack?
  • What is account takeover (ATO) fraud?
  • Eliminating password reuse to prevent ATO fraud
  • Developer Documentation (APIs)

Recent blog posts

  • Should Your Business Prevent Leetspeak in Passwords?
  • CISA: The Risk of MFA Without Improving Password Security
  • It’s W0rld P@ssw0rd D@y!
  • [ Sign Up for a Free Account ]
  • Contact Us
  • 1-720-773-4515

Enzoic ©2022 | Privacy Policy | Acceptable Use

3800 Arapahoe Avenue, Ste 250 l Boulder, CO 80303

Enzoic’s password auditor provides a great baseline for assessing password vulnerability. Get next level of compromised credentials protection and try the full Enzoic for Active Directory at no cost.

Cookies

This website uses cookies to improve your experience. Continue to use the site as normal if you agree to the use of cookies. To find out more about our use of cookies or to opt-out, please see our Privacy Policy.

More Information
This site is for EDUCATIONAL PURPOSES ONLY.
Your password will be sent securely to the Enzoic servers to check if it is compromised. We do not store your password or use it for any other purpose. If you are not comfortable with this, do not enter your real password.
What is this?

Password Check is a free tool that lets you determine not just the strength of a password (how complex it is), but also whether it is known to be compromised. Billions of user passwords have been exposed by hackers on the web and dark web over the years and as a result they are no longer safe to use. So even if your password is very long and complex, and thus very strong, it may still be a bad choice if it appears on this list of compromised passwords. This is what the Password Check tool was designed to tell you and why it is superior to traditional password strength estimators you may find elsewhere on the web.

Why is it needed?

If you are using one of these compromised passwords, it puts you at additional risk, especially if you are using the same password on every site you visit. Cybercriminals rely on the fact that most people reuse the same login credentials on multiple sites.

Why is this secure?

This page, and indeed our entire business, exists to help make passwords more secure, not less. While no Internet-connected system can be guaranteed to be impregnable, we keep the risks to an absolute minimum and firmly believe that the risk of unknowingly using compromised passwords is far greater. Since our database of compromised passwords is far larger than what could be downloaded to the browser, the compromised password check we perform must occur server-side. Thus, it is necessary for us to submit a hashed version of your password to our server. To protect this data from eavesdropping, it is submitted over an SSL connection. The data we pass to our server consists of three unsalted hashes of your password, using the MD5, SHA1, and SHA256 algorithms. While unsalted hashes, especially ones using MD5 and SHA1, are NOT a secure way to store passwords, in this case that isn’t their purpose – SSL is securing the transmitted content, not the hashes. Many of the passwords we find on the web are not plaintext; they are unsalted hashes of the passwords. Since we’re not in the business of cracking password hashes, we need these hashes submitted for more comprehensive lookups. We do not store any of the submitted data. It is not persisted in log files and is kept in memory only long enough to perform the lookup, after which the memory is zeroed out. Our server-side infrastructure is hardened against infiltration using industry standard tools and techniques and is routinely tested and reviewed for soundness.

More…
  • Visit our FAQ to learn more
  • Contact us for press or sales inquiries
  • Add a free password strength meter to your website