Credential Stuffing: Attacks And Economies

[stat e o f t h e int e rne t ] / s e c uri t yVolum e 5, S p e c ial M e di a E di t i o nCredential Stuffing:A tt ac ks andEc onomie s

IntroductionAkamai recorded nearly 30 billion credential stuffing attacks in 2018. Eachattack represented an attempt by a person or computer to log in to anaccount with a stolen or generated username and password. The vast majorityof these attacks were performed by botnets or all-in-one applications.Botnets are groups of computers tasked with various commands. TheyMedia organizations, gamingcompanies, and the entertainmentindustry are among the biggesttargets of credential stuffing attacks.can be instructed to find accounts that are vulnerable to being accessedby someone other than the account owner; these are called accounttakeover (ATO) attacks. AIO applications allow an individual to automatethe login or ATO process, and they are key tools for account takeoversand data harvesting.What does this have to do with media organizations, gaming companies,and the entertainment industry? A lot. These organizations are among thebiggest targets of credential stuffing attacks. The people behind theseattacks realize the value of an account, whether it’s to a streaming site,a game, or someone’s social media account. And they’re willing to dowhatever it takes to steal them.In this report, we’re going to give you an overview of the credentialstuffing attacks in 2018 against the aforementioned sectors and look at therisks these attacks pose. We’ll also explore some of the ways adversariesconduct these attacks.[state of the internet] / security Credential Stuffing: Attacks and EconomiesVolume 5, Special Media Edition2

Credential Stuffing Attempts Per DayJanuary 1 – December 31, 2018300MDate: October 24, 2018Login Attempts:285,983,922Date: June 2, 2018Login Attempts:252,176,323250MCredential Stuffing AttemptsDate: October 27, 2018Login Attempts:287,168,120200M150M100M50M0MJan 1Feb 1Mar 1Apr 1May 1Jun 1Jul 1Aug 1Sep 1Oct 1Nov 1Dec 1Jan 12018Attacks Per DayIn 2018, Akamai observed hundreds of millions of credential stuffingattacks each day. These attacks targeted a range of sectors, from mediaand entertainment to retail and gaming. As seen in Figure 1, there werethree days that peaked at more than 250 million attempts. Credentialstuffing attacks are becoming a favorite for criminals at all skill levels. WhileFigure 1Three of theprevious “State of the Internet” (SOTI) reports have examined their impactlargest attackson retail, this edition examines the media and entertainment sectors.observed in 2018are highlighted,Criminals target large video and entertainment brands, because access toincluding two thatverified accounts can be sold or traded in underground marketplaces. Ifoccurred withinyou’ve ever streamed a song, movie, or TV show online, you may alreadydays of each otherbe familiar with some of the accounts most criminals favor. The informationassociated with these accounts also has value.[state of the internet] / security Credential Stuffing: Attacks and EconomiesVolume 5, Special Media Edition3

Largest AttacksIn the video media sector alone, three of the largest credential stuffingattacks in 2018 jumped up from 133 million to nearly 200 million attempts.This is significant, because the dates of the attacks sync with known databreaches: The sellers may have been testing the credentials before theywere to be sold. In early February 2019, some 620 million usernames,passwords, and other records — taken from 16 organizations withFigure 2disclosed data breaches — were offered for sale on the darknet.Three of the largestCredential Stuffingcredential stuffingAt the start of 2019, you may have heard the news that an anonymousattacks against the videoindividual released a collection of email addresses and passwords,media sector duringhere referred to as “releases 1–5,” for credential stuffing.2018 ramped up from133 million to nearly200 million attemptsAttacks Per Day: Media IndustriesJanuary 1 – December 31, 2018220MVertical: Video MediaDate: October 27, 2018Login Attempts: 196,087,155200MVertical: Video MediaDate: October 25, 2018Login Attempts: 175,981,359180MCredential Abuse Attempts160M140MVertical: Video MediaDate: June 3, 2018Login Attempts: 133,861,006120M100M80M60M40M20M0MJan 1Feb 1Mar 1Apr 1May 1Jun 1Jul 1Aug 1Sep 1Oct 1Nov 1Dec 1Jan 12018VerticalMedia & EntertainmentVideo Media[state of the internet] / security Credential Stuffing: Attacks and EconomiesVolume 5, Special Media Edition4

Across these five collections, this anonymous person published nearly1 TB of data, amounting to more than 25 billion email address andpassword combinations. Once the duplicates and unusable entries wereremoved, there were still billions of combinations available in variousplaces online at the time this report was written.Figure 3SNIPR is a low-cost AIOused for credential stuffing;Releases 1–5 are just basic collections of usernames and passwords,it retails for 20 USDalthough they represent the largest collection ever released in a singleinstance. Such a massive collection is the exception and not the norm.But collections like this are created by merging combination lists fromother data breaches, including highly notable ones.Credential stuffing attacks are a major risk to online businesses, sohaving a pool of more than 1 billion potential combinations to pull fromlowers the bar of entry significantly for any would-be criminal looking tocash in on the credential stuffing trend. However, lists like these are notthe only way criminals collect the data they need to perform credentialstuffing attacks.In a YouTube video watched by Akamai researchers, an individual walkedviewers step-by-step through a tutorial on how to create combination liststo use against the popular online battle royale game.[state of the internet] / security Credential Stuffing: Attacks and EconomiesVolume 5, Special Media Edition5

The tutorial started by teaching the concept of “Google Dorking,”which uses Google’s search engine operators to locate websites thatare potentially vulnerable to SQL injection. Once the websites wereSNIPR Training Videoslocated, the tutorial then moved on to teach viewers how to exploit theseon YouTubevulnerable domains using a common SQL injection tool. This tool thendownloads email addresses and passwords, cracks passwords if needed,generates a valid combination list, and then follows up with a “checker”program with proxies to test its newly minted lists for validity.These checker programs, or All-in-One applications (AIOs), allow theattacker to validate stolen or generated credentials. Depending on theapplication, AIOs can target login forms directly, or APIs — or both, if thesituation calls for it.Once the accounts are confirmed as valid, they can be sold, traded, orharvested for various types of personal information. Depending on thesituation, it isn’t uncommon for all three things to happen.There are scores of AIOs online. Some are sold openly, and others aresold or traded underground. One of them, an application called SNIPR,While researching facts and datafor this report, Akamai researcherscame across a number of relatedYouTube videos dealing withcredential stuffing and associatedattacks. We were able to confirmthat at least 89,000 people havewatched demonstration and tutorialvideos on the AIO known as SNIPR.There are dozens of videos,spanning across several SNIPRversions, detailing how to usethe application, as well as how toget the most return on resourceinvestment. Since SNIPR is an entrylevel tool, such tutorials are oftenrequested by the tool’s users, whichare then created by the developersor other users.is favored as an entry-level tool by those looking to target games, socialmedia, and streaming media.Another AIO called STORM uses detailed configuration settings that aresold or traded in their own right. At the time of writing this report, oneseller on the darknet was promoting STORM configurations for use againstone of the largest streaming platforms online at a cost of 52 USD.The same seller is also selling gift card codes for the previously mentionedplatform at a discount — offering cards with a value of 30 for as little as 7.80 USD. These codes are sometimes generated, but more often thannot they’re purchased with stolen credit cards, so any money collected ispure profit for the criminal.This same retailer also does a steady business in selling credentialstuffing combination lists. One listing is a batch of 5 billion random emailaddresses and passwords for 5.20 USD. Another is a customized list of50,000 email addresses and passwords for the same price. The customizedoption allows the purchaser to choose format (email:pass or user:pass),provider, location, and more.[state of the internet] / security Credential Stuffing: Attacks and EconomiesVolume 5, Special Media Edition6

A Booming EconomyThe market for stolen media and entertainment accounts is thriving.The media, gaming, and entertainment industries are prized targets forcriminals who are looking to trade in stolen information and access. Theaccounts are sold in bulk, and the goal for the criminals is to move theirgoods by volume, rather than single account sales.Many accounts compromised via credential stuffing will sell for as little as 3.25 USD. These accounts come with a warranty: If the credentials don’twork once sold, they can be replaced at no cost, which is a service sellersoffer to encourage repeat purchases. The reason this service exists is thatbrands have become increasingly quick to detect compromised accountsand deactivate them.So how do credential stuffing attacks translate into stolen accounts that arelater sold on a criminal marketplace? Short answer: password sharing.Credential stuffing attempts can advance to full-blown account takeoversand compromises because people tend to use the same password acrossmultiple websites — or the passwords they are using are easily guessed,and they generated credentials.Top Attack SourcesSOURCE COUNTRYATO HEUR.LOGINSUnited 554,065Vietnam626,028,826the top source forIndia625,476,485credential tate of the internet] / security Credential Stuffing: Attacks and EconomiesVolume 5, Special Media EditionFigure 4Top attack sourcessorted by country; theUnited States remains7

Top Attack DestinationsDESTINATION COUNTRYATO HEUR.LOGINSUnited 445,535Germany760,722,969the top destination forAustralia104,655,154credential stuffing 632France1,864,733Hong Kong1,305,262Figure 5Top attack destinationssorted by country; theUnited States remainsSo a data breach at one website, or a massive release of knowncombinations of usernames and passwords (such as releases 1–5), cantranslate into one person having their entire digital life exposed. Once thathappens, every bit of information associated with said individual can bepackaged and sold.As expected, the United States topped the source country list forcredential stuffing attacks. This is because most of the common credentialstuffing tools are developed there. Russia hits a close second, with Canadain third place. Also, the United States is the number one spot for attackdestinations, because many of the most popular targets are based there.India and Canada are a close second and third for attack destinations, butare greatly overshadowed in volume compared with the United States.[state of the internet] / security Credential Stuffing: Attacks and EconomiesVolume 5, Special Media Edition“The United States is thenumber one spot forattack destinations.”8