Understanding Credential Stuffing Attacks
Security Boulevard, Thursday, September 19th, 2024
The firehose of security incidents - data breaches, ransomware, and supply chain attacks - often obscures the methods that attackers use to create these incidents. One of the most common is credential stuffing, which is a type of authentication-related attack that leads to account takeovers (ATO) and ultimately theft or fraud.
So, what is credential stuffing? Simplistically, it's when attackers use credentials obtained from previous attacks to try and log into websites, counting on the fact that people often re-use their passwords on multiple sites or applications.
In truth, credential stuffing is one of several common types of authentication-related attacks that also includes brute force and password spraying. The Open Worldwide Application Security Project (OWASP) does a great job of explaining these attacks, but a brief summary follows.