Why Credential Stuffing Attacks Are a Growing Threat

Credential stuffing attacks have become one of the most common ways cybercriminals break into accounts, largely because stolen usernames and passwords are so easy to obtain and reuse. With automated tools, attackers can quickly test huge lists of exposed credentials across different sites, hoping to find accounts that share the same login details. That’s why understanding how credential stuffing attacks work—and how to mitigate them—is critical for any organization that relies on password-based authentication.

We all know that data breaches have leaked billions of user credentials (usernames and passwords) on the public internet and dark web. The Global Password Security Report shows an alarming 50% of people reuse the same passwords across their personal and work accounts. If a cybercriminal obtains legitimate credentials for a personal account, they often can also get into that person’s work account because of this password reuse. As a result, compromised credentials are a threat to many other sites, not just the organization that had the data breach. Organizations need to mitigate credential stuffing.

How Attackers Use Exposed Credentials

Once the user name and password combinations for users are exposed, cybercriminals can leverage that data in various ways. Here are the most common:

• Access user accounts hosted on the site that was breached. This is known as account takeover, and the activity that a criminal can do within your account can include fraud and theft. 
• Attack with a method called “credential stuffing” where cybercriminals can use a bot with a list of exposed credentials against a website to gain access to an account on that site. When the bots successfully access an account, it is logged, and they can either access the account themselves, or they can sell that data to criminals on the dark web.

There are various ways for organizations to prevent credential stuffing attacks, but none are entirely 100% reliable in all cases.

8 Ways to Mitigate Credential Stuffing Attacks

Here are the pros and cons of each method.

1) Use a password manager like LastPass. 

LastPass can be used for individual usage, or employees can use it within an organization. LastPass securely stores usernames and passwords, so users don’t have to remember them. They only need to remember one master password (which they should never use anywhere else). Now that users don’t have to remember their passwords, they can create random, strong passwords, and never reuse them. With over 13.5 million customers and 47,000 business enterprise clients, LastPass enables ease-of-use while maintaining high security when it comes to passwords.

However, there are use cases, particularly in D2C environments where the use of a password manager is not possible on a broad scale.

For example, an online retailer cannot force its customers to use a password manager to log in to their website. In these cases where a password manager cannot be used, we recommend a layered approach with the following options during user or customer authentication.

2) Implement possession-based 2FA or MFA.

This requires the user to successfully present at least pieces of evidence in the form of a certain possession, like a smartphone or USB key. It is secure, but the risk is that in customer environments, customers get annoyed by it and abandon usage. It also requires them to have those devices on hand, and not everyone uses the same technologies, so it is only a partial solution. According to Google, fewer than 10% of its users have signed up for two-factor authentication to protect their Google accounts.

3) Use knowledge-based 2FA or MFA on a device.

This requires the user to successfully present at least pieces of evidence in the form of knowledge, like a security question. The challenge is that sometimes, users cannot recall their answers, which generates additional help desk inquiries.

4) Screen for exposed credentials.

When your user logs in, a proper credential screening tool compares their credentials (both user name and password) against a database containing billions of compromised credentials. This process works quietly in the background and takes place in milliseconds. If the user’s password and user name pair have been compromised, organizations can decide what to do next—for example: force a password reset, deploy step-up authentication, hide sensitive data on the account, etc. 

“LastPass leverages Enzoic to screen billions of compromised credentials so that we can alert our users in the aftermath of a 3rd party data breach and put additional security measures in place. With this, we can help block account takeover attempts and other fraudulent activities.”

Sandor Palfy, CTO, LastPass by LogMeIn

5) Leverage adaptive authentication.

These systems cross-reference IP address, geolocation, device reputation, and other behaviors to assign a risk score to an inbound login session and step-up authentication factors accordingly. 

6) Add a biometric authentication option.

This is an interesting solution where the user’s fingerprint or face is used to authenticate. Users need to use a device that has biometric capabilities, and many new devices include these biometric features in the form of fingerprint readers or facial recognition. 

7) Use a captcha or something that requires a human response.

CAPTCHA is a program or system intended to distinguish human from machine input, typically as a way of thwarting spam and automated extraction of data from websites. Simple checkboxes tend to be okay for end users, but requiring too much work from the end-user can cause frustration and abandonment. 

Overall, we found that captchas are often harder than they ought to be, with image captchas having an average solving time of 9.8 seconds… and audio captchas being much harder, with an average solving time of 28.4 seconds.

Stanford Captcha Study

8) Tracking traffic to your site.

There are also various technical ways to mitigate attacks, like reviewing where your traffic is coming from, limiting traffic coming from Autonomous System Numbers (ASNs), blocking automated browsers that are frequently used by hackers, and tracking logins because if you have a lot of logins failures, that could be a sign of credential stuffing. 

Why a Layered Approach Works Best

While there is no single way to always prevent credential stuffing attacks, applying a layered approach gives organizations the confidence that the success of credential stuffing attacks is significantly reduced, without negatively impacting the user experience.