We all use dozens or even hundreds of different online services: email providers, software applications, streaming services, newspaper subscriptions and much more. Each of these services asks us to create a login – usually at least a username and password. Often, however, these login details are stolen in one way or another and are sold as part of large password collections by cyber criminals. Hackers then use this login data by employing methods such as credential stuffing, for example, to make a profit from the stolen data.
Hackers regularly manage to access the databases of large online services and steal the login details of many, many users. This stolen data is then put up for sale on the dark net in the form of lists. The largest and best-known list is called “Collection #1-5” and contains over 2.2 billion combinations of usernames and passwords – around 900GB of data!
So, what can you do with a list like this? At first glance, not a lot. If a service provider becomes aware of the data theft, they warn their customers and ask them to change their password.
You can check to see if your email address has been published in the dark web on the Hasso Plattner Institute’s website.
Changing your password does stop hackers from accessing the account concerned. The problem is that many users are creatures of habit. They often use the same email address and password combination for several online services. This is where credential stuffing comes into play as the hackers can then use the stolen login data to their advantage.
You can find out more about password security in our feature article on the subject. You can also read about how to maintain an overview of all your logins with password managers in our Digital Guide.
With credential stuffing, attackers try to use stolen login details (or “credentials”) to access a system. When doing so, they try many different credentials that they have stolen from other online services. The aim of the attack is to obtain further valuable information from the hacked account, such as credit card numbers, addresses, saved documents, contact data – in short: any other data that they may be able to use to make a profit.
According to statistics, around every thousandth login attempt is successful. In other words, an attacker has to try 1000 different sets of login details to break into a system.
A hacker needs four things for a successful “credential stuffing” attack:
With these bots, hackers can try one login after another, systematically changing the originating IP address each time so that the target server doesn’t block the login attempts, as a well-configured server will usually block an IP address if the number of failed login attempts exceeds a certain threshold.
If the login is successful, the bot can then access the valuable information that we mentioned above. The successful login details are also saved for later use – for example for phishing attacks and other similar attacks.
Credential stuffing is often significantly more efficient that the following hacking methods:
The most simple and secure countermeasure is to use different passwords for different logins. While it’s not exactly convenient, it’s still less of a hassle to come up with a way of remembering all your different passwords than having to change the password for all your logins individually in the event of a security leak.
Find out how to protect yourself with a secure password.
Effective methods for using different passwords include:
Operators of websites, online stores, and online services have a range of options to choose from when it comes to protecting their users from credential stuffing:
SSL certificates from IONOS
Protect your domain and gain visitors' trust with an SSL-encrypted website!
Easy activationProven safety24/7 assistance
The internet is not new territory for scammers: Scamming encompasses all tricks that criminals use online in chats, via mail, or over social networks, to get unsuspecting people to give them their money. The criminals play their victims through deceitful methods on almost every platform across the internet: They build up a relationship, and eventually, lead their victims to make advance money...
Passwords are not an ideal way to surf the World Wide Web safely. They are either so complex that they are hard to remember, or so simple that they can be guessed in next to no time. FIDO2 takes a different approach and relies on modern technology. The open standard has the potential to make surfing the net safer and more convenient at the same time.
Security gaps in IT infrastructure can risk a company’s reputation or even threaten its survival. Where criminals manage to shut down company networks or gain access to sensitive data, financial and image-related damage becomes a certainty. SIEM (Security Information and Event Management) allows businesses to detect danger in real-time, allowing for appropriate and timely reactions.
In any system based on user accounts, Identity and Access Management has a role to play. So does every application use IAM? How important are Identity and Access Management systems when it comes to corporate compliance? And what features do these systems offer?
A shock was felt around the world at the end of 2021 when the Log4Shell vulnerability became known to the public. Attackers were able to completely take over remote systems without much effort. All major companies and many of the most widely used services were affected by it. In our article, we’ll explain why Log4Shell was so disastrous, how the exploits work, and what protective measures are...
Provide powerful and reliable service to your clients with a web hosting package from IONOS.
View packages
