Credential Stuffing

A credential stuffing attack is a cyber attack method in which stolen account credentials consisting of usernames, email addresses, and passwords are used to gain unauthorized access to user accounts. The attack uses bots for large-scale automated login requests directed against a web application and is based on the assumption that many users reuse usernames and passwords across multiple websites. Credential stuffing is one of the most common techniques used to overtake user accounts.

How credential stuffing attacks work

  1. The attacker obtains usernames and passwords via a website breach or password dump site.
  2. The attacker uses an account checker to test the stolen credentials against websites such as social media websites or online marketplaces.
  3. Of the tested stolen credentials, approximately 0.1-0.2% are successful. Successful logins allow the attacker to overtake the account matching the credentials.
  4. The account is then drained of any stored value, credit card numbers, and other personally identifiable information. In addition, the attacker can send spam or create further transactions from the hacked account.

Credential stuffing vs. brute force attack

Credential stuffing is similar to a brute force attack, which is when an attacker submits many passwords with the hope of eventually guessing correctly. It uses trial and error to guess at login information. Some categorize credential stuffing as a form of brute force attacks, and while they are similar, there are differences between the two.

Brute force attacks guess at credentials with no context and only succeed if users choose simple, guessable passwords. The success rate for these attacks are much lower. Credential stuffing uses exposed data, which dramatically reduces the number of possible correct credentials. Brute force attacks can be combated by a strong password, but password strength does not protect against credential stuffing.

Credential stuffing prevention

It’s quite simple to protect against a credential stuffing attack. Users should always use a unique password for each service that requires login credentials. This can be managed by using a password manager. If a different password is used for each account, credential stuffing will not work because the underlying assumption is that the passwords are all the same. As an added measure of security, users should enable multi-factor authentication when possible.

Webopedia Staff
Webopedia Staff
Since 1995, more than 100 tech experts and researchers have kept Webopedia’s definitions, articles, and study guides up to date. For more information on current editorial staff, please visit our About page.

Related Articles

Special Character

A special character is one that is not considered a number or letter. Symbols, accent marks, and punctuation marks are considered special characters. Similarly,...

Software

Table of contents What is Software? History of Software Software vs. Hardware Software vs. Hardware Comparison Chart What Types of Software Exist? Saas vs....

Email Address

What is an Email Address? An email address is a designation for an electronic mailbox that sends and receives messages, known as email, on a...

Information Technology (IT) Architect

The information technology architect applies IT resources to meet specific business requirements. The role requires a high degree of technical expertise as well as...

Geotargeting

Geotargeting is a method of delivering data or content to users based on...

Agile Project Management

Agile project management enables business teams to approach their projects and tasks with...

Private 5G Network

A private 5G network is a private local area network (LAN) that utilizes...