Multifactor Authentication Versus Credential Stuffing?

iStock-1171239056You shouldn’t assume multi-factor authentication will protect your accounts from credential stuffing attacks, according to Gerhard Giese at Akamai. Credential stuffing is a type of brute-force attack in which attackers use automated tools to test thousands of previously breached credentials against a login portal. Since many people reuse passwords across multiple accounts, the attackers have a better chance of guessing a correct combination than if they started from scratch.

“A thriving underground economy exists for buying, selling, and exploiting compromised account credentials,” Giese writes. “Billions of stolen credentials are available for purchase on the dark web. Free automation tools like Sentry MBA or SNIPR make it easy for bad actors to orchestrate logins and validate stolen credentials. And low-cost "botnet as a service" platforms enable criminals to carry out complex credential stuffing campaigns at scale.”

Multi-factor authentication (MFA) is one of the best ways to prevent attacks that exploit compromised credentials, but it isn’t foolproof. If an attacker guesses the credentials to an account protected by MFA, they won’t gain access to the account immediately, but they will know that they’ve come across a valid set of credentials. They can then launch targeted attacks to trick the victim into granting access to the account.

“With many MFA implementations, users first enter a user ID and password combination, and then are prompted to enter another piece of evidence like a code sent via email or SMS,” Giese explains. “A bad actor can exploit MFA to verify a user ID/password combination (most MFA solutions validate the user ID/password combination before generating the challenge code). With the user ID/password confirmed, the perpetrator can target the victim directly via a spear-phishing attack, sell the validated credentials on the dark web, or attempt some other malicious act. For comprehensive protection, introduce a multilayered, defense-in-depth security architecture, combining MFA with other safeguards.”

Users need to be on the lookout for the techniques attackers use to bypass multi-factor authentication. New-school security awareness training can give your employees the knowledge they need to protect themselves.

Akamai has the story:

Are your user’s passwords…P@ssw0rd?

Employees are the weakest link in network security, using weak passwords and falling for phishing and social engineering attacks. KnowBe4’s complimentary Weak Password Test (WPT) checks your Active Directory for several different types of weak password related threats.

wpt02Here's how it works:

  • Reports on the accounts that are affected
  • Tests against 10 types of weak password related threats
  • Does not show/report on the actual passwords of accounts
  • Just download the install and run it
  • Results in a few minutes!

Check Your Passwords

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Ransomware Has Gone Nuclear Webinar

Get the latest about social engineering

Subscribe to CyberheistNews