What is Cre­den­tial Stuffing?

We all use dozens or even hundreds of different online services: email providers, software ap­pli­ca­tions, streaming services, newspaper sub­scrip­tions and much more. Each of these services asks us to create a login – usually at least a username and password. Often, however, these login details are stolen in one way or another and are sold as part of large password col­lec­tions by cyber criminals. Hackers then use this login data by employing methods such as cre­den­tial stuffing, for example, to make a profit from the stolen data.

Hackers regularly manage to access the databases of large online services and steal the login details of many, many users. This stolen data is then put up for sale on the dark net in the form of lists. The largest and best-known list is called “Col­lec­tion #1-5” and contains over 2.2 billion com­bi­na­tions of usernames and passwords – around 900GB of data!

So, what can you do with a list like this? At first glance, not a lot. If a service provider becomes aware of the data theft, they warn their customers and ask them to change their password.

Changing your password does stop hackers from accessing the account concerned. The problem is that many users are creatures of habit. They often use the same email address and password com­bi­na­tion for several online services. This is where cre­den­tial stuffing comes into play as the hackers can then use the stolen login data to their advantage.

With cre­den­tial stuffing, attackers try to use stolen login details (or “cre­den­tials”) to access a system. When doing so, they try many different cre­den­tials that they have stolen from other online services. The aim of the attack is to obtain further valuable in­for­ma­tion from the hacked account, such as credit card numbers, addresses, saved documents, contact data – in short: any other data that they may be able to use to make a profit.

According to sta­tis­tics, around every thou­sandth login attempt is suc­cess­ful. In other words, an attacker has to try 1000 different sets of login details to break into a system.

A hacker needs four things for a suc­cess­ful “cre­den­tial stuffing” attack:

• A list of login details
• A list of popular online services that they want to attack (e.g., Dropbox, Adobe Cloud, Canva, etc.)
• A technique that allows them to use a high number of different IP addresses (IP rotation)
• A “bot” (computer program) that makes login attempts on the various online services com­plete­ly au­to­mat­i­cal­ly

With these bots, hackers can try one login after another, sys­tem­at­i­cal­ly changing the orig­i­nat­ing IP address each time so that the target server doesn’t block the login attempts, as a well-con­fig­ured server will usually block an IP address if the number of failed login attempts exceeds a certain threshold.

If the login is suc­cess­ful, the bot can then access the valuable in­for­ma­tion that we mentioned above. The suc­cess­ful login details are also saved for later use – for example for phishing attacks and other similar attacks.

Cre­den­tial stuffing is often sig­nif­i­cant­ly more efficient that the following hacking methods:

• Brute-Force attacks require a much higher number of tries as only random password com­bi­na­tions are tried and not, like with cre­den­tial stuffing, existing passwords.
• Social en­gi­neer­ing usually limits the attack to just one platform (e.g., Amazon), while cre­den­tial stuffing can attack hundreds of different online services at the same time.

The most simple and secure coun­ter­mea­sure is to use different passwords for different logins. While it’s not exactly con­ve­nient, it’s still less of a hassle to come up with a way of re­mem­ber­ing all your different passwords than having to change the password for all your logins in­di­vid­u­al­ly in the event of a security leak.

Effective methods for using different passwords include:

• A password formula, that is the same for all passwords. One good method is to mix the platform name with a fixed number com­bi­na­tion. So, your password for Dropbox would be dro33pbox22 and for Amazon it would be ama33zon22, for example.
• Using a password manager; here you can choose between using an app and a browser add-on.
• Using several email addresses and usernames for the different platforms and changing the password each time.

Operators of websites, online stores, and online services have a range of options to choose from when it comes to pro­tect­ing their users from cre­den­tial stuffing:

• TOTP-based au­then­ti­ca­tion: uses of a one-off temporary password (time-based one-time password) for the login
• Multi-factor au­then­ti­ca­tion: works by sending an SMS code to the user’s smart­phone, for example
• Block headless browsers: like those used by bots
• Block traffic from data centers: like Amazon Web Services or IBM Watson, for example, as bots are often operated from data centers like this
• Use spe­cial­ized security software: for example, WordPress offers the plugin Wordfence Login Security
• Device fin­ger­print­ing: this method iden­ti­fies different prop­er­ties of users’ computers, such as the MAC address, the hard drive size, etc. and trans­forms it into a hash value so that any login attempts from foreign computers can be spotted im­me­di­ate­ly.