Credential stuffing. What is it?
In a world of smart-enabled devices — smartphones, smart TVs, smart
assistants, even smart cars — passwords are the most common way
hackers use to compromise accounts and access personal data.
Credential stuffing is a type of cyberattack in which
stolen account credentials, typically consisting of lists of usernames
and/or email addresses and the corresponding passwords (often from a
data breach), are used to gain unauthorized access to user accounts
through large-scale automated login requests directed against a web
application.*
In reality, this is a very simple hacker technique. Consider the
scenario below:
-
John created a special password combination consisting of uppercase
and lowercase letters, numbers, and special characters. Because he
does not want to remember multiple passwords, he created one that
can be accepted in multiple websites.
-
This password is then used to access his preferred websites, such as
a food delivery application, the social network where he posts
family photos, a podcast site, his personal email account and online
banking account. It is also used to access his online banking.
-
His favorite podcast website was compromised, and the website’s
administrator is not aware of the incident. Thousands of login ID
and password combinations were leaked, including John’s, and
secretly traded among hackers.
-
Hackers use these known valid login ID and password combinations and
try to access multiple websites. Eventually, they successfully
access John’s data included in his websites of interest: his phone
number, full address, personal email and where he works. There is
also a bank statement that he downloaded and sent to his email
account the previous week.
-
A week later, he receives a mysterious call from someone allegedly
from the bank’s fraud prevention team, asking for a code that was
sent to his cellphone. He feels something might be wrong, and
decides to call the bank, discovering it was a fraud attempt.
How can I prevent credential stuffing?
Do not use the same password in different websites of personal and
professional interest. Use a unique password for nationalprimepay
Bank, not equal or similar to any you use in other websites.
Whenever possible, create different passwords on websites with
different contexts, especially those that may affect your finances.
Banks usually require step-up authentication when an unusual
transaction is detected, a new device is used or the type of activity
and/or amount requested does not match the customer’s profile.
This is commonly performed with an additional code sent to the user’s
cellphone. Do not provide this code to anyone; it is meant to be used
on computer systems.
*Source: Wikipedia.com
