How to protect your business and your customers against credential stuffing attacks

Nearly everyone knows that reusing passwords across multiple sites and systems is a security risk, but most people continue to do it anyway. As a result, credential stuffing attacks abound, especially among retailers. Dunkin’ Donuts has been victimized twice in the past three months by hackers seeking access into customers’ DD Perks loyalty program accounts.

What is credential stuffing?

Credential stuffing takes advantage of two problems in the current cyber threat environment: (1) massive data breaches that compromise large numbers of login credentials and (2) people’s propensity to reuse passwords. Armed with these credentials, hackers set up bots that attempt to use them to gain access to accounts on other sites; that’s where the “stuffing” part comes in.

Credential stuffing attacks are endemic in the retail industry; it’s estimated that credential stuffing accounts for 90% of global traffic to online retail sites, where hackers seek to grab loyalty points that can be converted into cash, airline points, or merchandise, such as in the Dunkin’ Donuts attacks. Retailers aren’t the only potential target for credential stuffing; these types of attacks make up about 60% of traffic to consumer banking and airline sites, and any company whose customers sign up for online accounts is at risk. Hackers recently used credential stuffing to access TurboTax tax preparation software accounts.

Despite the ubiquity of credential stuffing, about 32% of companies lack visibility into this type of attack, and another 30% admit being unable to detect or mitigate credential stuffing attacks.

Preventing credential stuffing attacks

Individuals can prevent having their accounts taken over by using a password manager, which will allow them to easily generate a different, secure password for each of their accounts. They should also opt for multi-factor authentication whenever possible.

While enterprises can and should implore their customers not to recycle passwords, in the end, they cannot control what their customers choose to do. There is also no magic bullet to completely halt credential stuffing attacks on the enterprise’s side. Most websites already monitor authentication logs for large numbers of login attempts from specific IP addresses or address spaces. Knowing this, hackers use credential stuffing tools that make it appear as though their login attempts are coming from different IPs and even different browsers.

However, companies can take proactive steps to mitigate credential stuffing attacks, such as:

• Allow users to secure their accounts through multi-factor authentication (MFA). In addition to preventing credential stuffing, MFA provides a competitive advantage. As credential stuffing and other cyber attacks multiply, consumers are becoming increasingly leery of sites that don’t offer MFA protection.
• Regularly check compromised accounts lists and require password resets for any users who appear on a list.
• Require periodic password resets for all users.
• Enable CAPTCHAs. Yes, they can be bypassed, but they at least put a hurdle in hackers’ way. Project management site Basecamp recently used a CAPTCHA to halt a credential stuffing attack.
• Continuously monitor your systems for warning signs and mitigation of possible credential stuffing activity and other cyber abuse.
• Consult with a reputable cyber security firm, such as Lazarus Alliance, regarding implementing JavaScript restrictions and other specific technical controls.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.