Cybersecurity
Credential Stuffing
Credential stuffing is an automated attack using stolen username/password combinations from data breaches to attempt logins on other services. The attack exploits password reuse by users across different platforms.
What is Credential Stuffing?
Credential Stuffing Definition
Credential stuffing is an automated attack type where adversaries use large lists of stolen credentials (from data breaches) to attempt mass authentication on other websites and applications. The attack relies on a common user behavior - using the same password across multiple services.
How does credential stuffing work?
- Data breach - attackers obtain credentials from a breached service
- Lists - millions of email/password combinations
- Automation - bots attempt mass logins
- Success - 0.1-2% success rate (password reuse)
- Account takeover - access to compromised accounts
Credential Stuffing vs Brute Force
| Aspect | Credential Stuffing | Brute Force |
|---|---|---|
| Passwords | Known (from breaches) | Generated/guessed |
| Speed | Fast (known credentials) | Slow (many attempts) |
| Success rate | Higher | Lower |
| Detection | Harder (valid credentials) | Easier (many failures) |
Credential Stuffing Attack Scale
- Billions of credentials available on dark web
- Millions of login attempts per day
- 0.1-2% typical success rate
- Attacks across multiple platforms simultaneously
Tools and Techniques
Attacker tools:
- Sentry MBA, OpenBullet
- Custom bots
- Proxy rotation services
- CAPTCHA solving services
Evasion techniques:
- IP rotation
- Slow attack rate
- Mimicking legitimate browsers
- Residential proxies
Credential Stuffing Defense
Technical controls:
- Multi-factor authentication (MFA)
- CAPTCHA/reCAPTCHA
- Rate limiting
- IP reputation
- Device fingerprinting
- Anomaly detection (unusual locations, devices)
Organizational:
- Breach monitoring (Have I Been Pwned)
- Forcing password changes after breaches
- User education about password reuse
Impact of Credential Stuffing
- Account takeover: Access to user accounts
- Financial fraud: E-commerce, banking
- Data theft: Personal data from accounts
- Reputation damage: Loss of user trust
- Operational costs: Handling incidents
Credential stuffing is one of the most common attacks on web applications, requiring a multi-layered defense approach and MFA implementation.