Evolution
I wrote a piece on passwords more than 3 years ago and it generated many comments from industry players. I’ve also written articles on data breaches regularly. This time round I've combined the two. The problem hasn’t gone away, in fact it has morphed into an industry with specialisation, where specific entities concentrate on writing new code to exploit vulnerabilities, obtaining new credentials, testing them, packaging them up with other value-add services and some supplying verified credentials sold for pennies per hundred.
I’ve started writing this as an update, but I don’t like bringing up problems without corresponding solutions, so there is a section written as a how-to.
Why credential stuffing works
Credential stuffing leads to account takeovers; it relies on the fact that people tend to stick with the same username, typically their email address and reuse their passwords across different platforms and services.
Maturing of the underground
Read the image description
The pyramid places administrators and subject-matter experts at the top, intermediaries and brokers and then vendors in the middle, and witting mules, general members and unwitting mules towards the base. The upper roles are labelled sophisticated or highly skilled, the middle roles may be sophisticated or unsophisticated, and the lower roles are labelled less skilled. Example activities include exploit development, malware writing, identity collection, botnet operation, cashing out and buying stolen data. The diagram is conceptual and does not give numerical proportions.
Cyber criminal activities have developed and matured. This is demonstrated by the division of labour, specialisation, market driven malware and customer service. The pyramid on the right neatly describes this.
There are entities which concentrate on value-add, these aggregate account information and sell on account packs, say with email, online retail, auction sites and social media accounts for 10s of dollars, some even offer warranty the goods, if the credentials are reset before the buyer can use them, they are swapped for another set. This is information is used to facilitate account take over fraud.
Cyber criminality and organised crime
There is ample evidence that national and trans-national criminals have moved into cyber crime as another means of low-risk, high return business. As in any well-run business, investment into new services and tools are part of the strategy. They are already well versed in the movement of monies, though layering and laundering, to make black money turn into clean money.
MaaS – Malware-as-a-Service
There are online auctions and bidding for zero day exploits (code or services which exploit vulnerabilities in systems which are not in general circulation) and some command hundreds of thousands of dollars (USD). Once these have been in use for a few months, their value diminishes and but is still useful on lower value targets and these may be re-marketed at a lower price or sold as MaaS, malware-as-a-service where a complete platform is available for hire. This lowers the cost of entry and helps distance the perpetrator from the victim.
The massive leaked username and password lists
The raw figures are startling :
1.8 billion credentials were leaked online
and were made available to all so far (July 2019). Troy Hunt, as cyber security blogger and researcher has designed a tool that checks to see if your username or password is in that list. It also helps you identify when and where that leak occurred.
(Source : 2019 Credential Spill Report – Shape Security)
Where did this information come from?
The bulk of credential leaks are from direct hacks of company databases, such as
- Dropbox 68 million (2012)
- Uber 57 million (2016)
- Equifax 145 million (2017)
- Yahoo! 3 billion (2017)
- Marriot International 500 million (2018)
- Facebook 90 million (2018)
this is just a small sample. Information released include names, addresses, email, password, credit card details, date of birth, passport numbers and a gamut of other details.
https://www.theguardian.com/technology/2016/aug/31/dropbox-hack-passwords-68m-data-breach
https://www.bbc.co.uk/news/business-41493494
https://fortune.com/2018/04/12/uber-data-breach-security/
https://www.itpro.co.uk/data-breaches/29418/equifax-data-breach-cost-14-billion-so-far
https://www.consumer.ftc.gov/blog/2018/12/marriott-data-breach
Phishing
Read the image description
Phishing is illustrated as a broad, automated attack aimed at many possible victims. Spear-phishing is illustrated as a customised attack directed at a specific person or company.
This is a form of social engineering. Mass emails used to target a wide number of people to persuade people to part with their details, which may be in the form of asking for the information (the sender is purporting to be someone of authority), directing them spoof-sites with a login box or directing them to where credentials are stolen or malware is installed on their device, be it laptop or phone. Mobile devices like phones and tablets are typically less well protected compared with desktop and PCs, even in the corporate environment. Some are easy to spot, but many are well crafted with good grammar which makes them easily mistaken for the genuine article. Targeted attacks are referred to as spear-phishing, as high-value targets are sought and their position and status is leveraged by the criminals.
“The average impact of a successful spear-phishing attack: $1.6 million”
(Source : Vanson Bourne. “The Impact of Spear Phishing.” 2016.)
Malware
Is software designed to manipulate the user or the user’s device to record a user’s credentials. Some of these appear transparent to the user by passing the details through to the legitimate system leaving the user none the wiser. More alarming is that many can be a backdoor to the corporate network which provides a conduit for malware and further loss of information.
What does it mean for me? Why should I care?
Your service account details are in the public domain. But you ask, “what can actually happen? It isn't that important...” You lose control of the account, any credits may be spent or transferred away. For example, if it’s an online auction account, it may be used to commit fraud by selling non-existent items and pocketing the money. The risk to you is multiplied significantly if you reuse your credentials across different platforms and services, especially if it’s a login to your bank account or your primary email account used to reset passwords for bank accounts.
Read the image description
The sequence is Harvest Credentials, Test Credentials, Gain Access and Steal Assets. Stolen credentials, obtained through phishing or man-in-the-browser attacks, are tested by a botnet against web servers. Successful logins provide access to assets such as banking and financial information, medical records and intellectual property.
Bottomline – the risk to you
Main issue is the identity loss; the imposter can do things whilst pretending to be you leading to the loss of control. They can :
1) Take out loans in your name and disburse it so that it is near impossible to recover
2) Sell your property, including your home
3) Commit crimes with your identity
There are many examples where people have lost their house deposits due to account takeover fraud. Recovery from any of these is complicated and involved.
This will normally lead to financial loss and damage to credit profile (loss of reputation). This is a similar path that criminals take with companies as we’ll see below.
What does it mean for my organisation?
Corporations are also susceptible to these types of attacks. Very often high value targets are identified and combined with psychological persuasion, commonly known as social engineering. Common approaches include the use of invoice and imposter fraud. Some figures will put this into perspective.
In 2018 UK businesses reported a loss £93M
due to invoice fraud. The unreported figure is likely to be significantly higher, as there is little compulsion for firms to report this type of crime.
(Source : FRAUD THE FACTS 2019, UK Finance)
Imagine if your organisation’s online bank details were compromised. Even if no monies were lost, the amount of disruption caused just to recover from this is significant, where PCs in the organisation have to be checked and sanitised. Increased scrutiny of invoice, purchase orders and various ledgers.
From a service operations perspective, many companies have reported a significant uptick in credential stuffing attacks, where criminals are testing millions of stolen credentials on various accounts, everything from food delivery, online sales portals, ticket booking sites and so on. For example Deliveroo (UK) and Just Eat (UK) have been complaining of food being ordered without their consent and delivered to addresses they have no knowledge of.
Even if the details being validated against a service provider proves to be incorrect, it is an overhead which is multiplied by hundreds of thousands, whereupon it becomes significant and degrades the service for legitimate users. When the credentials are proven to work, the code deployed by the criminals quickly marks it as live and tested. This will then lead to account take over or to be sold on to others. The legitimate user then complains to the service provider and complains that the provider has been hacked and compromised. This imposes a negative effect on brand reputation. There are also clean-up costs associated with reinstating the account. Of course there are many mitigation strategies touted by cyber security providers, some based on geo-location, IP address, user behaviour etc. but they’re not free and is still a drag on the infrastructure and people resources.
80-90% of an e-tailer’s login traffic is attributed to credential stuffing
(Source: 2019 Credential Spill Report – Shape Security)
What can I do about it? How do I protect myself?
Best approach in the case of passwords and account takeovers
- Don’t reuse passwords
- Don’t share your password with others
- Many people are aware that passwords like Password123, LetMeInN0W, 111222333, 12345678910 and n0password are weak and easily guessed. In general avoid single dictionary words and popular sports teams like “newyorkgiants”, “manunited2019” or sci-fi terms like “Ncc1701”, “youngWizardHP” and “Gandalf1988” as these are in common passwords lists.
- Do try using long non-sensical pass phrases works well (like “7seatedAngryTruffles6” or “carpet-lion-steameD-5280”, “bonjour.25kumkwat. tschuss”)
In general
- Keep your device up to date with software updates
- Keep you antivirus software up to date
- Learn to recognise scam emails
- Type in URLs, “Universal resource locator” basically the internet address, the www. bit manually and don’t rely on short-cuts or search engines, it’s worth checking the actual URL on two different devices.
- Avoid clicking on links, which includes photos
- If something is unlikely or “too good to be true” it usually is
- Be aware that social engineering can take other forms, from the classic “you’ve got a broken tile”, “we’re council contractors with an excess of tarmac” to “we have detected a virus on your home PC”.
- Inform your neighbours, friends and relatives, especially ones which are not so computer savvy, as the same exploits are used over and over again.
For organisations
In terms of phishing and social engineering, regular and targeted training is the most effective against combating these types of attacks. It provides the best value, as it has been proven, the humanware side of the equation is the most susceptible to manipulation. Most of the hints and tips for personal protection is also applicable in the organisation.
In fact I’ve found that helping your employees protect themselves at home is a much better approach than a dry corporate presentation, as it is something they can relate to immediately and is unanimously well-received every time I’ve gone this route. Combine it with drinks and sandwiches and you’re onto a sure-fire winner.
Possible solutions
Multi-factor authentication (using more than one form of independent validation, like a code sent to a mobile phone or a code generating device) and Captcha (https://en.wikipedia.org/wiki/CAPTCHA) are some of the techniques employed to bolster the reliability of authentication systems, both are costly in terms of the user experience or in deployment, there is a tipping point when the security becomes more important than convenience or cost which is something that needs to be decided by the business.
Where do we go from here?
Account takeover (Credential stuffing) is likely to be with us for a long time. It’s not an easy task to change people’s behaviour, but it is something worth pursuing and will bring dividends in the long run.
In the meantime, it is for organisations and regulatory bodies to help consumers protect themselves.
Businesses need to take a balanced approach to this with cohesive plans backed by positive action.
If I was to use a short one-liner, it’ll be this:
“Don’t reuse passwords”
I also maintain a web log. If you've enjoyed this article, do take a look here for more
Personal commentary. Views are the author’s own.