{"cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://feedproxy.google.com/~r/TheAkamaiBlog/~3/VDoGnLvkIYw/data-breaches-and-credential-stuffing-dont-get-tkod.html", "references": [], "enchantments_done": [], "_object_types": ["robots.models.rss.RssBulletin", "robots.models.base.Bulletin"], "id": "AKAMAIBLOG:A9BD0F6F61D9AC4FB20653693625A826", "history": [{"lastseen": "2017-10-05T19:12:55", "differentElements": ["modified"], "edition": 1, "bulletin": {"cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://feedproxy.google.com/~r/TheAkamaiBlog/~3/VDoGnLvkIYw/data-breaches-and-credential-stuffing-dont-get-tkod.html", "id": "AKAMAIBLOG:A9BD0F6F61D9AC4FB20653693625A826", "history": [], "modified": "2017-10-05T17:29:03", "type": "akamaiblog", "description": "It has been a very rough month for the information security community. It feels like we've been on the losing end of a championship fight against Floyd Mayweather. \n\nThe body shots started with [Equifax](<https://investor.equifax.com/news-and-events/news/2017/09-07-2017-213000628> \"Equifax Breach\" ) and continued with [attacks on the ](<https://www.sec.gov/news/press-release/2017-170>)[US Government](<https://www.sec.gov/news/press-release/2017-170>). The assault included a couple of combination shots as Equifax expanded the scope of their breach by adding millions of additional impacted accounts and as reports emerged that this was not the first breach for Equifax in 2017.\n\nThen came a left hook when [Yahoo](<https://help.yahoo.com/kb/account/SLN28451.html?impressions=true>) updated users that the previously described breach impacting only ~ 1 billion users in fact impacted all ~3 billion Yahoo accounts. It should be noted that Yahoo suffered several breaches, but this week's announcement is not a fresh breach. Rather, Yahoo's investigation has concluded that the previous breaches were larger than previously suspected and they are disclosing those details.\n\nYahoo's disclosures have explained that the billions of user passwords were hashed with MD5 and apparently were not salted, making it much easier and less expensive for an adversary to recover in plain text.\n\n[](<https://blogs.akamai.com/assets_c/2017/10/punched-in-face-6480.html>)\n\n**Why it Matters: Account Takeover Attacks (ATO)**\n\nBased on data collected by Akamai's Cloud Security Intelligence, big data platform, the most common task assigned to botnets on the public internet is Credential Stuffing. Botnets responsible for Credential Stuffing are more than an order of magnitude larger than the botnets, like [Mirai](<https://www.akamai.com/us/en/about/our-thinking/threat-advisories/akamai-mirai-botnet-threat-advisory.jsp>) that power large DNS attacks. Credential Stuffing is the mass-scale automated testing of username/password combinations across multiple websites. When successful matches are discovered, attackers use these logins to take over the account for fraud or resell the confirmed credentials to others to commit fraud.\n\nThe engine used for Credential Stuffing attacks is composed of several components. The first is the bot or bot framework driving the account brute force attempts. This could be something as simple as the Sentry MBA tool that is a full service tool or bespoke tools used by more sophisticated attackers. In an attempt to avoid detection, attackers typically employ vast networks of proxy servers to pass along requests to the target. This allows them to keep their average request rate from a given IP to a specific target to an average rate of less than 1 per hour. [Akamai's researchers discovered](<https://blogs.akamai.com/2016/10/when-things-attack.html>) that attackers are using a vulnerability in many IoT devices to amass these networks of proxy servers.\n\nIf these tools and botnets are the engines for ATO/Credential Stuffing, then spilled user credentials like we have seen with the Yahoo breaches are the fuel that powers the engine. Three billion user credentials being spilled in this breach certainly provides a huge volume of fuel for the Credential Stuffing engines. It is estimated that more than 50% of users re-utilize the same password across most or all sites they visit. I've spoken to several Security/Fraud teams that have confirmed that they've seen huge batches of @yahoo credentials used in credential stuffing attack campaigns.\n\n**Be Proactive: Steps You Can Take to Protect Yourself and Your Data**\n\nSuggestions for Consumers/End Users:\n\n * Realize that disclosures about breaches are often delayed, potentially for years.\n * Assume credentials you've used for login on the internet for longer than a few weeks have been compromised and change them.\n * Akamai recommends regularly rotating passwords and using unique passwords for each site you visit.\n\nSuggestions for Website Owners:\n\n * The most frequent attack observed by Akamai's security big data analytics platform emanating from botnets on the internet is Credential Stuffing, the first stage of Account Takeover Attacks.\n * Spilled credentials like the Yahoo! Breach add fresh fuel for attackers. They'll try these credentials on numerous sites looking to exploit users who've re-used their credentials.\n * Website admins should exercise best practices when storing user credentials \n * Salt and hash passwords with strong hashing algorithms\n * NIST publishes [guidelines](<https://pages.nist.gov/800-63-3/sp800-63b.html>) that are regularly updated\n\n**Learn More: Exclusively at Akamai EDGE 2017**\n\nI'm excited to be moderating a Credential Stuffing panel with Security and Fraud Executives from Visa, Fidelity, Sony, and Nordstrom in Floyd Mayweather's hometown of Las Vegas at the Akamai Edge Wednesday [October 11th at 3:40pm](<https://edge.akamai.com/ec/us/sessions-training/session-schedule.jsp>). We won't talk about the Yahoo breaches specifically during this session. We will hear from top industry experts about the fallout from these breaches, like Yahoo!, where millions or billions of credentials are spilled and discuss how that drives Credential Stuffing/Account Takeover. The expert panel will discuss strategies for defending against Credential Stuffing and discuss how they see these attacks evolving over time.\n\n", "published": "2017-10-05T16:43:17", "cvelist": [], "title": "Data Breaches and Credential Stuffing: Don't Get TKOd", "lastseen": "2017-10-05T19:12:55", "viewCount": 30, "enchantments": {}, "reporter": "Patrick Sullivan", "bulletinFamily": "blog", "objectVersion": "1.4", "references": []}}, {"lastseen": "2017-10-11T23:13:30", "differentElements": ["description", "modified"], "edition": 2, "bulletin": {"cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://feedproxy.google.com/~r/TheAkamaiBlog/~3/VDoGnLvkIYw/data-breaches-and-credential-stuffing-dont-get-tkod.html", "id": "AKAMAIBLOG:A9BD0F6F61D9AC4FB20653693625A826", "history": [], "modified": "2017-10-11T20:19:33", "type": "akamaiblog", "description": "It has been a very rough month for the information security community. It feels like we've been on the losing end of a championship fight against Floyd Mayweather. \n\nThe body shots started with [Equifax](<https://investor.equifax.com/news-and-events/news/2017/09-07-2017-213000628> \"Equifax Breach\" ) and continued with [attacks on the ](<https://www.sec.gov/news/press-release/2017-170>)[US Government](<https://www.sec.gov/news/press-release/2017-170>). The assault included a couple of combination shots as Equifax expanded the scope of their breach by adding millions of additional impacted accounts and as reports emerged that this was not the first breach for Equifax in 2017.\n\nThen came a left hook when [Yahoo](<https://help.yahoo.com/kb/account/SLN28451.html?impressions=true>) updated users that the previously described breach impacting only ~ 1 billion users in fact impacted all ~3 billion Yahoo accounts. It should be noted that Yahoo suffered several breaches, but this week's announcement is not a fresh breach. Rather, Yahoo's investigation has concluded that the previous breaches were larger than previously suspected and they are disclosing those details.\n\nYahoo's disclosures have explained that the billions of user passwords were hashed with MD5 and apparently were not salted, making it much easier and less expensive for an adversary to recover in plain text.\n\n[](<https://blogs.akamai.com/assets_c/2017/10/punched-in-face-6480.html>)\n\n**Why it Matters: Account Takeover Attacks (ATO)**\n\nBased on data collected by Akamai's Cloud Security Intelligence, big data platform, the most common task assigned to botnets on the public internet is Credential Stuffing. Botnets responsible for Credential Stuffing are more than an order of magnitude larger than the botnets, like [Mirai](<https://www.akamai.com/us/en/about/our-thinking/threat-advisories/akamai-mirai-botnet-threat-advisory.jsp>) that power large DNS attacks. Credential Stuffing is the mass-scale automated testing of username/password combinations across multiple websites. When successful matches are discovered, attackers use these logins to take over the account for fraud or resell the confirmed credentials to others to commit fraud.\n\nThe engine used for Credential Stuffing attacks is composed of several components. The first is the bot or bot framework driving the account brute force attempts. This could be something as simple as the Sentry MBA tool that is a full service tool or bespoke tools used by more sophisticated attackers. In an attempt to avoid detection, attackers typically employ vast networks of proxy servers to pass along requests to the target. This allows them to keep their average request rate from a given IP to a specific target to an average rate of less than 1 per hour. [Akamai's researchers discovered](<https://blogs.akamai.com/2016/10/when-things-attack.html>) that attackers are using a vulnerability in many IoT devices to amass these networks of proxy servers.\n\nIf these tools and botnets are the engines for ATO/Credential Stuffing, then spilled user credentials like we have seen with the Yahoo breaches are the fuel that powers the engine. Three billion user credentials being spilled in this breach certainly provides a huge volume of fuel for the Credential Stuffing engines. It is estimated that more than 50% of users re-utilize the same password across most or all sites they visit. I've spoken to several Security/Fraud teams that have confirmed that they've seen huge batches of @yahoo credentials used in credential stuffing attack campaigns.\n\n**Be Proactive: Steps You Can Take to Protect Yourself and Your Data**\n\nSuggestions for Consumers/End Users:\n\n * Realize that disclosures about breaches are often delayed, potentially for years.\n * Assume credentials you've used for login on the internet for longer than a few weeks have been compromised and change them.\n * Akamai recommends regularly rotating passwords and using unique passwords for each site you visit.\n\nSuggestions for Website Owners:\n\n * The most frequent attack observed by Akamai's security big data analytics platform emanating from botnets on the internet is Credential Stuffing, the first stage of Account Takeover Attacks.\n * Spilled credentials like the Yahoo! Breach add fresh fuel for attackers. They'll try these credentials on numerous sites looking to exploit users who've re-used their credentials.\n * Website admins should exercise best practices when storing user credentials \n * Salt and hash passwords with strong hashing algorithms\n * NIST publishes [guidelines](<https://pages.nist.gov/800-63-3/sp800-63b.html>) that are regularly updated\n\n**Learn More: Exclusively at Akamai EDGE 2017**\n\nI'm excited to be moderating a Credential Stuffing panel with Security and Fraud Executives from Visa, Fidelity, Sony, and Nordstrom in Floyd Mayweather's hometown of Las Vegas at the Akamai Edge Wednesday [October 11th at 3:40pm](<https://edge.akamai.com/ec/us/sessions-training/session-schedule.jsp>). We won't talk about the Yahoo breaches specifically during this session. We will hear from top industry experts about the fallout from these breaches, like Yahoo!, where millions or billions of credentials are spilled and discuss how that drives Credential Stuffing/Account Takeover. The expert panel will discuss strategies for defending against Credential Stuffing and discuss how they see these attacks evolving over time.\n\n", "published": "2017-10-05T16:43:17", "cvelist": [], "title": "Data Breaches and Credential Stuffing: Don't Get TKOd", "lastseen": "2017-10-11T23:13:30", "viewCount": 30, "enchantments": {}, "reporter": "Patrick Sullivan", "bulletinFamily": "blog", "objectVersion": "1.4", "references": []}}], "modified": "2017-10-20T00:19:32", "lastseen": "2017-10-20T01:34:25", "published": "2017-10-05T16:43:17", "description": "It has been a very rough month for the information security community. It feels like we've been on the losing end of a championship fight against Floyd Mayweather. \n\nThe body shots started with Equifax ([https://investor.equifax.com/news-and-events/news/2017/09-07-2017-213000628](<https://investor.equifax.com/news-and-events/news/2017/09-07-2017-213000628>)) and continued with attacks on the US Government (<https://www.sec.gov/news/press-release/2017-170>). The assault included a couple of combination shots as Equifax expanded the scope of their breach by adding millions of additional impacted accounts and as reports emerged that this was not the first breach for Equifax in 2017.\n\nThen came a left hook when Yahoo(<https://help.yahoo.com/kb/account/SLN28451.html?impressions=true> ) updated users that the previously described breach impacting only ~ 1 billion users in fact impacted all ~3 billion Yahoo accounts. It should be noted that Yahoo suffered several breaches, but this week's announcement is not a fresh breach. Rather, Yahoo's investigation has concluded that the previous breaches were larger than previously suspected and they are disclosing those details.\n\nYahoo's disclosures have explained that the billions of user passwords were hashed with MD5 and apparently were not salted, making it much easier and less expensive for an adversary to recover in plain text.\n\n[](<https://blogs.akamai.com/assets_c/2017/10/punched-in-face-6480.html>)\n\n**Why it Matters: Account Takeover Attacks (ATO)**\n\nBased on data collected by Akamai's Cloud Security Intelligence, big data platform, the most common task assigned to botnets on the public internet is Credential Stuffing. Botnets responsible for Credential Stuffing are more than an order of magnitude larger than the botnets, like Mirai (<https://www.akamai.com/us/en/about/our-thinking/threat-advisories/akamai-mirai-botnet-threat-advisory.jsp>) that power large DNS attacks. Credential Stuffing is the mass-scale automated testing of username/password combinations across multiple websites. When successful matches are discovered, attackers use these logins to take over the account for fraud or resell the confirmed credentials to others to commit fraud.\n\nThe engine used for Credential Stuffing attacks is composed of several components. The first is the bot or bot framework driving the account brute force attempts. This could be something as simple as the Sentry MBA tool that is a full service tool or bespoke tools used by more sophisticated attackers. In an attempt to avoid detection, attackers typically employ vast networks of proxy servers to pass along requests to the target. This allows them to keep their average request rate from a given IP to a specific target to an average rate of less than 1 per hour. Akamai's researchers discovered that attackers are using a vulnerability in many IoT devices to amass these networks of proxy servers.(<https://blogs.akamai.com/2016/10/when-things-attack.html>)\n\nIf these tools and botnets are the engines for ATO/Credential Stuffing, then spilled user credentials like we have seen with the Yahoo breaches are the fuel that powers the engine. Three billion user credentials being spilled in this breach certainly provides a huge volume of fuel for the Credential Stuffing engines. It is estimated that more than 50% of users re-utilize the same password across most or all sites they visit. I've spoken to several Security/Fraud teams that have confirmed that they've seen huge batches of @yahoo credentials used in credential stuffing attack campaigns.\n\n**Be Proactive: Steps You Can Take to Protect Yourself and Your Data**\n\nSuggestions for Consumers/End Users:\n\n * Realize that disclosures about breaches are often delayed, potentially for years.\n\n * Assume credentials you've used for login on the internet for longer than a few weeks have been compromised and change them.\n\n * Akamai recommends regularly rotating passwords and using unique passwords for each site you visit. \n\n\nSuggestions for Website Owners:\n\n * The most frequent attack observed by Akamai's security big data analytics platform emanating from botnets on the internet is Credential Stuffing, the first stage of Account Takeover Attacks.\n\n * Spilled credentials like the Yahoo! Breach add fresh fuel for attackers. They'll try these credentials on numerous sites looking to exploit users who've re-used their credentials. \n \n\n\n * Website admins should exercise best practices when storing user credentials\n\n * Salt and hash passwords with strong hashing algorithms\n\n * NIST publishes guidelines that are regularly updated ([https://pages.nist.gov/800-63-3/sp800-63b.html](<https://pages.nist.gov/800-63-3/sp800-63b.html>))\n\n * Consider utilizing MFA on login interfaces\n\n**Learn More: Exclusively at Akamai EDGE 2017**\n\nI'm excited to be moderating a Credential Stuffing panel with Security and Fraud Executives from Visa, Fidelity, Sony, and Nordstrom in Floyd Mayweather's hometown of Las Vegas at the Akamai Edge Wednesday October 11th at 3:40pm (https://edge.akamai.com/ec/us/sessions-training/session-schedule.jsp). We won't talk about the Yahoo breaches specifically during this session. We will hear from top industry experts about the fallout from these breaches, like Yahoo!, where millions or billions of credentials are spilled and discuss how that drives Credential Stuffing/Account Takeover. The expert panel will discuss strategies for defending against Credential Stuffing and discuss how they see these attacks evolving over time.\n\n", "title": "Data Breaches and Credential Stuffing: Don't Get TKOd", "cvelist": [], "_object_type": "robots.models.rss.RssBulletin", "viewCount": 30, "enchantments": {"score": {"value": 0.2, "vector": "NONE", "modified": "2017-10-20T01:34:25"}, "dependencies": {"references": [], "modified": "2017-10-20T01:34:25"}, "vulnersScore": 0.2}, "reporter": "Patrick Sullivan", "bulletinFamily": "blog", "objectVersion": "1.4", "type": "akamaiblog"}

{}