Credential stuffing

Description

Nothing here is guessed: the passwords are real, they simply come from somewhere else. Tools built for this can push thousands and millions of pairs through login forms from many addresses, imitating perfectly ordinary users, so blocking by source address helps little. It only takes a small share of people reusing a password for the attack to pay. The share of people who recycle their passwords is, unfortunately, large.

The only real defense against this is that one password is never used on more than one service. Two-factor authentication matters too, because it blocks the reuse of stolen credentials. Giving every service its own password requires a password manager. Without one the task is effectively impossible — nobody remembers the 150 passwords an average user has accounts for.

Examples

• An employee's password leaks from the site of a large software vendor. That same password, more often than not, also opens their business mail and their private accounts. For the attacker, the abuse can begin.
• A well-known web shop takes a wave of logins from users whose data leaked on a competing platform. A good share of the accounts will be compromised — that much is certain.
• When an attacker finds several sets of credentials from the same company and the same domain on a dark web market, the odds that the leaked credentials still work rise sharply.

Notes

• Compared with other methods, this one does not guess the credentials but where else the victim has used them.
• If one password opens several accounts, one compromise puts all the others under threat. A unique password per account breaks that chain.