A credential stuffing attack is a cyber attack method in which stolen account credentials consisting of usernames, email addresses, and passwords are used to gain unauthorized access to user accounts. The attack uses bots for large-scale automated login requests directed against a web application and is based on the assumption that many users reuse usernames and passwords across multiple websites. Credential stuffing is one of the most common techniques used to overtake user accounts.
How credential stuffing attacks work
- The attacker obtains usernames and passwords via a website breach or password dump site.
- The attacker uses an account checker to test the stolen credentials against websites such as social media websites or online marketplaces.
- Of the tested stolen credentials, approximately 0.1-0.2% are successful. Successful logins allow the attacker to overtake the account matching the credentials.
- The account is then drained of any stored value, credit card numbers, and other personally identifiable information. In addition, the attacker can send spam or create further transactions from the hacked account.
Credential stuffing vs. brute force attack
Credential stuffing is similar to a brute force attack, which is when an attacker submits many passwords with the hope of eventually guessing correctly. It uses trial and error to guess at login information. Some categorize credential stuffing as a form of brute force attacks, and while they are similar, there are differences between the two.
Brute force attacks guess at credentials with no context and only succeed if users choose simple, guessable passwords. The success rate for these attacks are much lower. Credential stuffing uses exposed data, which dramatically reduces the number of possible correct credentials. Brute force attacks can be combated by a strong password, but password strength does not protect against credential stuffing.
Credential stuffing prevention
It’s quite simple to protect against a credential stuffing attack. Users should always use a unique password for each service that requires login credentials. This can be managed by using a password manager. If a different password is used for each account, credential stuffing will not work because the underlying assumption is that the passwords are all the same. As an added measure of security, users should enable multi-factor authentication when possible.
