Credential Stuffing Definition

What is Credential Stuffing?

Many people use weak passwords or use the same password across multiple different accounts, undermining the security that passwords provide for user authentication. Credential stuffing attacks take advantage of this fact by attempting to use common passwords or a password exposed in a data breach to log into a user’s other accounts.

How Does Credential Stuffing Work?

Password-based authentication systems rely on the assumption that a user will have a unique, long, and random password for all of their online accounts. This forces an attacker to perform a brute force search for each account’s password, and, if that password is long enough, such an attack quickly becomes infeasible.

However, most people don’t follow password security best practices. They use shorter or weaker passwords that are easy to remember, or they use the same password for multiple different accounts.

Credential stuffing is an automated attack that takes advantage of these password security errors. Cybercriminals collect lists of weak passwords or ones that have been exposed in data breaches and sold on the Dark Web.

Automated bots use these password lists to identify potentially vulnerable accounts. Each bot will be given a list of potential accounts and passwords for various sites. The bot will then try to log into a user’s account with the provided password. If they succeed, then the attacker has access to the user’s account.

Credential stuffing attacks are commonly performed by botnets, which are composed of many compromised machines (typically IoT devices). Using a distributed network of bots can speed up the process of testing potential passwords and makes it more difficult for a site to detect and block the malicious login attempts.

Protecting Against Credential Stuffing Attacks

A successful credential stuffing attack provides the attacker with access to a user’s account, which can be used for various malicious purposes. Some best practices for protecting against these types of attacks include:

• Strong Passwords: If an application uses a password-based authentication system, then it should enforce the use of strong passwords. Passwords should be long, random, and not used across multiple sites.
• Multi-Factor Authentication (MFA): MFA requires the use of two or more authentication factors to access a user’s account. This makes credential stuffing attacks less effective since the attacker also needs access to the other authentication factors.
• Lockouts and Throttling: Credential stuffing attacks rely on the attacker’s ability to efficiently try multiple potential passwords for an attack. Locking accounts after a certain number of incorrect attempts or slowing down login attempts can make these attacks less effective.
• Strong Authentication: Credential stuffing takes advantage of the poor security of password-based authentication. Switching to a more secure authentication method — such as biometrics — can eliminate credential stuffing risks.

Conclusion

Credential stuffing is a common attack that takes advantage of poor password security to gain access to users’ accounts. The threat of credential stuffing attacks can be reduced by implementing strong MFA or eliminated entirely by moving away from password-based authentication to biometrics or similar, more secure authentication methods.