What is Credential Stuffing?

In credential stuffing, attackers use stolen or leaked login credentials and attempt to automatically access various websites and services using these credentials, usually with the help of a botnet. This attack is based on the assumption that most people are relatively lazy and repeatedly use the same login credentials.

Why is Credential Stuffing dangerous?

Successful credential stuffing attacks can cause significant damage to both private individuals and businesses. Private individuals often face financial damages - for example, when a bank account is emptied or when thousands of euros worth of items are ordered on Amazon. Companies have to deal with a wider range of problems. For instance, customer data might be stolen because an employee reused their credentials for the CRM system. Besides reputational damage, legal consequences may also threaten if personal data is stolen. In general, this attack is so widespread because it is incredibly easy to carry out. Large leak databases continuously provide Black Hat Hackers with new fresh and valid credentials.

What methods do attackers use in Credential Stuffing?

The credentials are often bought on the darknet. Public leak databases are also a popular source. Infostealer log files can now also be downloaded for free via Telegram. This data is processed by attackers and then tested against various services - including PayPal, Amazon, GoogleMail, and many others - using special tools. Usually, the traffic is routed through proxy servers, making it very difficult to identify the attacker. However, the main reason for this is usually to make blocking the attacks more difficult.

When do Credential Stuffing attacks occur more frequently?

Globally organized credential stuffing attacks can be observed more frequently especially when, for example, a major service has been hacked and credentials are being sold on the darknet. APT groups are relatively quick here - especially when the APT's focus is financial gain.

How do I protect myself from Credential Stuffing?

Those who use a unique password for each service are relatively safe. Password managers simplify things tremendously. For important services, using 2FA or MFA is absolutely mandatory - this prevents successful logins even though a third party has the valid credentials.

How do you prevent Credential Stuffing attacks on your own services?

From a developer's perspective, there are several measures that can be implemented to protect your customers. Implementing Captcha is one possibility - however, it must be mentioned that most Captchas no longer present a hurdle thanks to GenAI. A good and sensible measure would be rate limiting - an account should be locked if a certain number of failed logins is detected. However, the best protection remains 2FA or MFA - for important services, you should not do without it or even make it mandatory. Penetration tests can help verify these measures.