Credential Stuffing
Credential Stuffing [T1110.004]
Last updated
Credential Stuffing [T1110.004]
Last updated
Name: Credential Stuffing
ID: T1110.004
Tactics:
Technique:
Credential Stuffing (T1110.004) is a sub-technique within the MITRE ATT&CK framework under the Credential Access tactic. Credential stuffing involves automated injection of breached username-password pairs into login forms to gain unauthorized access to user accounts. Attackers leverage credentials leaked from previous data breaches, exploiting the common practice of password reuse across multiple services. This technique is prevalent due to its simplicity, automation capabilities, and the widespread availability of compromised credential databases.
Credential stuffing is executed through automated scripts or specialized tools designed to rapidly test large volumes of compromised credentials against authentication endpoints. Attackers typically follow these technical steps:
Credential Collection: Attackers obtain compromised credential sets from publicly available data breaches, underground forums, or dark web marketplaces.
Credential Preparation: Credential lists are cleaned, formatted, and aggregated into standardized formats compatible with credential stuffing tools. Common formats include plain-text lists, CSV files, or JSON objects.
Proxy and Infrastructure Setup: Attackers often utilize proxy services or botnets to distribute login attempts across multiple IP addresses, bypassing rate limits, IP blocking, and detection mechanisms.
Automated Credential Testing: Attackers employ automated tools and scripts, such as OpenBullet, Sentry MBA, SNIPR, or custom Python scripts, to systematically test credentials against targeted authentication endpoints. These tools typically:
Support multi-threaded requests to accelerate the testing process.
Rotate proxies and user-agent strings to evade detection.
Provide detailed logging and reporting on successful login attempts.
Account Access and Exploitation: Successfully authenticated accounts are accessed for malicious purposes, including:
Financial fraud and theft.
Identity theft and impersonation.
Data exfiltration and espionage.
Further lateral movement within targeted networks.
Credential stuffing is commonly employed across various attack scenarios and stages, including:
Initial Access Stage: Attackers leverage credential stuffing to gain initial footholds into personal accounts, corporate networks, cloud services, or third-party platforms.
Account Takeover (ATO) Campaigns: Credential stuffing is frequently used to execute mass account takeover campaigns targeting financial institutions, e-commerce, social media, and streaming services.
Targeted Espionage and Reconnaissance: Attackers utilize credential stuffing to access sensitive corporate accounts, email inboxes, or collaboration tools, facilitating espionage and reconnaissance activities.
Financial Fraud and Theft: Compromised financial accounts provide attackers with direct opportunities for monetary gain through unauthorized transactions, theft, or resale of account access.
Credential Validation and Resale: Cybercriminals often validate credentials through credential stuffing before reselling verified accounts on underground marketplaces.
Organizations can detect credential stuffing attempts through various detection methods, tools, and indicators of compromise (IoCs):
Behavioral Analytics and Anomaly Detection:
Detection of abnormal spikes in login attempts from unusual IP addresses or geographic locations.
Identification of anomalous login patterns (e.g., high volume of failed attempts within short periods).
Rate Limiting and Threshold Monitoring:
Monitoring and alerting on excessive login attempts from single IP addresses or user-agent strings.
Implementing thresholds to detect automated login attempts.
IP Reputation and Threat Intelligence Feeds:
Utilizing threat intelligence feeds to identify known malicious IP addresses, proxies, or botnets associated with credential stuffing activities.
Web Application Firewalls (WAFs) and Security Gateways:
Deployment of WAFs with rules specifically designed to detect and mitigate credential stuffing attacks.
Leveraging built-in WAF signatures and custom rules to detect automated login attempts.
Multi-Factor Authentication (MFA) Logs:
Analyzing MFA logs for unusual patterns or multiple failed MFA challenges that may indicate credential stuffing attempts.
Specific IoCs:
Repeated failed login attempts from different IP addresses.
High volume of login attempts targeting multiple accounts from single IP or IP ranges.
Sudden increase in account lockouts or password reset requests.
Early detection of credential stuffing attacks is crucial due to potential severe impacts on systems, networks, and data, including:
Unauthorized Account Access: Attackers gain access to sensitive personal, corporate, or financial accounts, leading to privacy breaches, financial losses, and reputational damage.
Financial and Operational Impact: Credential stuffing attacks can cause significant financial losses, fraudulent transactions, and operational disruptions due to compromised accounts and remediation efforts.
Data Breaches and Compliance Violations: Unauthorized access resulting from credential stuffing may lead to data breaches, exposing confidential information and causing compliance violations (e.g., GDPR, PCI DSS).
Reputational Damage: Organizations face severe reputational harm if customers lose trust due to compromised accounts and perceived security weaknesses.
Risk of Further Compromise and Lateral Movement: Successful credential stuffing attacks can provide attackers with initial footholds, enabling lateral movement and deeper network penetration.
Real-world examples demonstrating credential stuffing attacks, utilized tools, and impacts include:
Disney+ Credential Stuffing Attack (2019):
Attackers leveraged credential stuffing to compromise thousands of Disney+ streaming accounts shortly after service launch.
Credentials were obtained from previous breaches and tested using automated scripts and tools.
Compromised accounts were sold on underground marketplaces, resulting in financial losses and reputational harm for Disney.
Dunkin' Donuts Credential Stuffing Attack (2018):
Attackers conducted credential stuffing attacks targeting Dunkin' Donuts customer accounts, obtaining unauthorized access to DD Perks loyalty accounts.
Attackers extracted personal information and used compromised accounts to conduct fraudulent transactions.
Dunkin' faced regulatory scrutiny, reputational damage, and increased operational costs due to remediation efforts.
HSBC Credential Stuffing Attack (2018):
Attackers utilized credential stuffing to compromise HSBC online banking accounts.
Compromised credentials were leveraged to conduct unauthorized financial transactions and theft.
HSBC incurred significant financial losses, regulatory investigations, and reputational damage.
Spotify Credential Stuffing Attacks (2020):
Cybercriminals leveraged credential stuffing to compromise Spotify user accounts, accessing premium subscriptions and personal information.
Compromised accounts were resold on underground forums and marketplaces.
Spotify users experienced unauthorized account access, financial loss, and privacy concerns, impacting Spotify’s reputation and customer trust.
These examples highlight the widespread usage of credential stuffing across various industries, underscoring the critical importance of detection and mitigation strategies.