Account takeover enables mass credit card fraud, identity theft and damage to brands and their reputation. We give you a brief overview of Account Takeover, how it happens and how to prevent it.

1. Data Security
What is Account Takeover
A brief introduction to web fraud

2. Data Security Account Takeover
What is account takeover?
1. A brief description
2. How attackers commit account takeover
3. Why it is so damaging
4. Prevention
5. Detection
2

3. Data Security Account Takeover
What is Account Takeover
Obtaining access to a legitimate
user‟s online account, often through
the theft of login credentials
Simple Description
3

4. Data Security Account Takeover
Top 3 Access Methods
1. Phishing or Spear Phishing
e.g. sending a highly targeted email purporting to be an IT
Department which directs the user to ‘update’ their password.
How attackers commit Account Takeover
4

5. Data Security Account Takeover
Top 3 Access Methods
2. Stolen details and „horizontal‟ login attempts
e.g. Stolen username and password lists obtained from other
websites’ database breaches. People often reuse their
passwords across all of their user accounts – attackers simply
test these known details horizontally.
How attackers commit Account Takeover
5

6. Data Security Account Takeover
Top 3 Access Methods
3. Man-in-the-middle attacks
e.g. an attacker creates a Wi-Fi hotspot which is identical to
the one used by the target company. Employee’s of that
company’s phones and computers will auto-connect to the Wi-
Fi, allowing the attacker to control all of their web-traffic,
harvest login details and collect ‘login cookies’ that tell the
website the user has successfully logged in and doesn’t need
to re-enter their password.
How attackers commit Account Takeover
6

7. Data Security Account Takeover
Why Account Takeover is So
Damaging
1. Hard to detect
It can be carried out without the user or administrators knowledge or
mistake.
2. Targeted
Using LinkedIn to target specific employees, attackers are able to gain
access to nearly any computer system – such as the corporate website or
database.
3. Identity Theft
Once they have access, it is very easy for attackers to assume the real
users identity. In a corporate setting then can create new user accounts for
themselves through self-service portals, steal private information or move
funds. In a consumer setting – resetting all the user’s passwords and
spending against their credit cards 7

8. Data Security Account Takeover
Preventing Account Takeover
Prevention is only one half of the solution
1. Consider “one-time passwords”
mitigates against password reuse and phishing attacks.
2. Use HTTPs where possible.
Consumer websites such as Facebook and Gmail have the option to
enforce this. HTTPs reduces the chances of your password being stolen
over public Wi-Fi (or anyone on your network)
3. Improve Wi-Fi Security
Turn off Wi-Fi auto-connect on laptops and phones. For company devices,
consider requiring VPN (with one-time passwords) to login to corporate
accounts
8

9. Data Security Account Takeover
Detecting Account Takeover
Detection is required – if somebody‟s one time password generator is
stolen, they are still open to Account Takeover
 Be aware of user‟s behavior, ethically.
Have they started to interact with your web service in a different manner
than usual? e.g. from a different country, using a non-corporate operating
system?
 Dynamic authentication.
Understand the risk of an action and the security surrounding this. E.g.
What is the risk of allowing a user to download the full client database?
Should a secondary security check be required, such as a phone-call to
verify the user? There are off-the-shelf, configurable products such as
NuDetect which do this.
9