Credential Stuffing

A credential stuffing attack is a cyber attack method in which stolen account credentials consisting of usernames, email addresses, and passwords are used to gain unauthorized access to user accounts. The attack uses bots for large-scale automated login requests directed against a web application and is based on the assumption that many users reuse usernames and passwords across multiple websites. Credential stuffing is one of the most common techniques used to overtake user accounts.

How credential stuffing attacks work

  1. The attacker obtains usernames and passwords via a website breach or password dump site.
  2. The attacker uses an account checker to test the stolen credentials against websites such as social media websites or online marketplaces.
  3. Of the tested stolen credentials, approximately 0.1-0.2% are successful. Successful logins allow the attacker to overtake the account matching the credentials.
  4. The account is then drained of any stored value, credit card numbers, and other personally identifiable information. In addition, the attacker can send spam or create further transactions from the hacked account.

Credential stuffing vs. brute force attack

Credential stuffing is similar to a brute force attack, which is when an attacker submits many passwords with the hope of eventually guessing correctly. It uses trial and error to guess at login information. Some categorize credential stuffing as a form of brute force attacks, and while they are similar, there are differences between the two.

Brute force attacks guess at credentials with no context and only succeed if users choose simple, guessable passwords. The success rate for these attacks are much lower. Credential stuffing uses exposed data, which dramatically reduces the number of possible correct credentials. Brute force attacks can be combated by a strong password, but password strength does not protect against credential stuffing.

Credential stuffing prevention

It’s quite simple to protect against a credential stuffing attack. Users should always use a unique password for each service that requires login credentials. This can be managed by using a password manager. If a different password is used for each account, credential stuffing will not work because the underlying assumption is that the passwords are all the same. As an added measure of security, users should enable multi-factor authentication when possible.

Webopedia Staff
Since 1995, more than 100 tech experts and researchers have kept Webopedia’s definitions, articles, and study guides up to date. For more information on current editorial staff, please visit our About page.

Top Articles

The Complete List of 1500+ Common Text Abbreviations & Acronyms

From A3 to ZZZ we list 1,559 SMS, online chat, and text abbreviations to help you translate and understand today's texting lingo. Includes Top...

Windows Operating System History & Versions

The Windows operating system (Windows OS) refers to a family of operating systems developed by Microsoft Corporation. We look at the history of Windows...

How to Create a Website Shortcut on Your Desktop

Website Shortcut on Your Desktop reviewed by Web Webster   This Webopedia guide will show you how to create a website shortcut on your desktop using...

Generations of Computers (1st to 5th)

Reviewed by Web Webster Learn about each of the 5 generations of computers and major technology developments that have led to the computing devices that...

Pardot

What is Pardot? Pardot is a B2B marketing automation (MA) solution by Salesforce that...

Veeam

Veeam Software is a global vendor...

Akamai

Akamai Technologies is a global web technology company specializing in content...