Download to read offline
Uploaded byDevOps Indonesia
API Security Webinar : Credential Stuffing
Credential stuffing involves using breached username and password pairs from one site to attempt to log in to other sites where users may have reused passwords. It occurs in four main steps: 1) obtaining credentials from data breaches, 2) automating the login process without human interaction, 3) defeating any login defenses, and 4) distributing the process globally through botnets and cloud hosting. While two-factor authentication prevents account takeovers, credential stuffing can still reveal valid user accounts. Users and organizations are encouraged to take steps like using unique passwords, password managers, and two-factor authentication to help mitigate credential stuffing risks.
Travelâ—¦
API Security Webinar : Credential Stuffing
- 1. | ©2021 F5NETWORKS 1 June 2021 Alexander Marcel Credential Stuffing
- 2. “Credential Stuffing issuper effective because it takes advantage of human behavior where majority is using same password for multiple services” CREDENTIAL STUFFING cre.den.tial stuff.ing The replay of a breached username/password pairs across sites to find accounts where passwords have been reused.
- 3. | ©2021 F5NETWORKS 3 Confidential / / Part of F5 Get Credentials Automate Login Distribute Globally Defeat Automation Defenses (if any) 1 2 3 CREDENTIAL STUFFING 4 cre.den.tial stuff.ing The replay of a breached username/password pairs across sites to find accounts where passwords have been reused. STEPS OF CREDENTIAL STUFFING
- 4. CREDENTIAL STUFFING Step 1 GetCredentials
- 5. CREDENTIAL STUFFING Step 2 AutomateLogin No user interaction No device or browser spoofing Poor device/browser spoofing Excellent device/browser spoofing
- 6. CREDENTIAL STUFFING Step 2 AutomateLogin * No programming skills required. Create script in visual constructor.
- 7.
- 8. | ©2021 F5NETWORKS 8 Confidential / / Part of F5 CREDENTIAL STUFFING Step 3 Defeat Defenses (if any)
- 9. CREDENTIAL STUFFING Step 3 DefeatDefenses (if any)
- 10. CREDENTIAL STUFFING Step 3 DefeatDefenses (if any)
- 11. CREDENTIAL STUFFING Step 3 DefeatDefenses (if any)
- 12. CREDENTIAL STUFFING Step 3 DefeatDefenses (if any) What about 2FA ? 2FA does not stop Credential Stuffing 2FA stops automated account takeovers. The point of credential stuffing is to find valid accounts. Credential stuffing, even with 2FA, still results in valid accounts.
- 13. CREDENTIAL STUFFING Step 3 DefeatDefenses (if any) How can attacker bypass 2FA ? 1. Social Engineering 2. Phising (RTPP) 3. Sim Swapping 4. etc.. 472618
- 14.
- 15. | ©2021 F5NETWORKS 15 Attack Kill Chain Stolen credentials Botnets,cloud hosting,proxies Loginbehavior simulationtools CAPTCHAsolving tools starting: $0 $2 per 1000 IPs $50 per site config $1.39 per 1000 Because resources are cheap and widely available, it can cost just $200 to takeover 1000 accounts via credential stuffing.
- 16. CREDENTIAL STUFFING Call ToAction for All Users 1. haveibeenpwned.com 2. Make your passwords unique 3. Use password manager 4. Enable 2FA 5. Review your social media privacy setting and so on.. please check securitycheckli.st
- 17. CREDENTIAL STUFFING Call ToAction for IT Security & Anti Fraud Team alexander.marcel@f5.com
- 18. | ©2021 F5NETWORKS 18 Thank You & Stay Healthy