API Security Webinar - Credential Stuffing
0 likes72 views
Credential stuffing exploits the common practice of password reuse across multiple services by replaying breached username/password pairs to access accounts. The process involves four steps: obtaining credentials, automating login attempts, defeating security defenses, and distributing attacks globally. Despite two-factor authentication (2FA) being in place, credential stuffing can still lead to successful account takeovers through methods like social engineering and phishing.
API Security Webinar - Credential Stuffing
- 1. | ©2021 F5 NETWORKS 1 June 2021 Alexander Marcel Credential Stuffing
- 2. “Credential Stuffing is super effective because it takes advantage of human behavior where majority is using same password for multiple services” CREDENTIAL STUFFING cre.den.tial stuff.ing The replay of a breached username/password pairs across sites to find accounts where passwords have been reused.
- 3. | ©2021 F5 NETWORKS 3 Confidential / / Part of F5 Get Credentials Automate Login Distribute Globally Defeat Automation Defenses (if any) 1 2 3 CREDENTIAL STUFFING 4 cre.den.tial stuff.ing The replay of a breached username/password pairs across sites to find accounts where passwords have been reused. STEPS OF CREDENTIAL STUFFING
- 4. CREDENTIAL STUFFING Step 1 Get Credentials
- 5. CREDENTIAL STUFFING Step 2 Automate Login No user interaction No device or browser spoofing Poor device/browser spoofing Excellent device/browser spoofing
- 6. CREDENTIAL STUFFING Step 2 Automate Login * No programming skills required. Create script in visual constructor.
- 7. CREDENTIAL STUFFING Step 2 Automate Login
- 8. | ©2021 F5 NETWORKS 8 Confidential / / Part of F5 CREDENTIAL STUFFING Step 3 Defeat Defenses (if any)
- 9. CREDENTIAL STUFFING Step 3 Defeat Defenses (if any)
- 10. CREDENTIAL STUFFING Step 3 Defeat Defenses (if any)
- 11. CREDENTIAL STUFFING Step 3 Defeat Defenses (if any)
- 12. CREDENTIAL STUFFING Step 3 Defeat Defenses (if any) What about 2FA ? 2FA does not stop Credential Stuffing 2FA stops automated account takeovers. The point of credential stuffing is to find valid accounts. Credential stuffing, even with 2FA, still results in valid accounts.
- 13. CREDENTIAL STUFFING Step 3 Defeat Defenses (if any) How can attacker bypass 2FA ? 1. Social Engineering 2. Phising (RTPP) 3. Sim Swapping 4. etc.. 472618
- 14. CREDENTIAL STUFFING Step 4 Distribute Globally
- 15. | ©2021 F5 NETWORKS 15 Attack Kill Chain Stolen credentials Botnets,cloud hosting,proxies Loginbehavior simulationtools CAPTCHAsolving tools starting: $0 $2 per 1000 IPs $50 per site config $1.39 per 1000 Because resources are cheap and widely available, it can cost just $200 to takeover 1000 accounts via credential stuffing.
- 16. CREDENTIAL STUFFING Call To Action for All Users 1. haveibeenpwned.com 2. Make your passwords unique 3. Use password manager 4. Enable 2FA 5. Review your social media privacy setting and so on.. please check securitycheckli.st
- 17. CREDENTIAL STUFFING Call To Action for IT Security & Anti Fraud Team alexander.marcel@f5.com
- 18. | ©2021 F5 NETWORKS 18 Thank You & Stay Healthy