Understanding and preventing credential stuffing attacks

The End Is Nigh

Hopefully the content covered here has opened your eyes to a very real threat faced by today's Internet users.

The key thing to remember is that the success of these types of attacks is generally not down to user error directly. Instead, these attacks are a result of an online service attracting enough attention and not plugging security holes properly, which allows a data breach. Of course, if you use the same password across multiple services and one online service suffers a breach, you are making a rod for your own back.

Use a password manager if you struggle with unique, complex passwords and choose which services you use carefully – not all vendors are equal. Also, always use MFA!

Infos

  1. Intelligence X: https://intelx.io
  2. SANS Institute: https://www.sans.org/blog/what-is-open-source-intelligence
  3. Intelligence X blog post on data breach: https://blog.intelx.io/2020/11/20/open-government
  4. Sample password breach file: https://github.com/danielmiessler/SecLists/blob/master/Passwords/Leaked-Databases/000webhost.txt
  5. Leaked data: https://www.zdnet.com/article/000webhost-hacked-13-million-customers-exposed
  6. Daniel Miessler: https://github.com/danielmiessler
  7. Imperva: https://www.imperva.com/learn/application-security/credential-stuffing
  8. Sample username breach file: https://github.com/danielmiessler/SecLists/tree/master/Usernames
  9. Top 1,000 list of male names in USA: https://github.com/danielmiessler/SecLists/blob/master/Usernames/Names/malenames-usa-top1000.txt
  10. Hydra: https://github.com/vanhauser-thc/thc-hydra
  11. Hydra README: https://github.com/vanhauser-thc/thc-hydra/blob/master/README
  12. Docker Hub login: https://login.docker.com
  13. Docker access tokens: https://docs.docker.com/security/for-developers/access-tokens/
  14. Configuring a credential helper: https://docs.docker.com/engine/reference/commandline/login/#credentials-store
  15. CrowdStrike: https://www.crowdstrike.com/cybersecurity-101/password-spraying
  16. Fail2Ban: https://www.fail2ban.org
  17. "Intrusion Detection with Fail2Ban" by Chris Binnie, Linux Magazine website, May 22, 2012: https://www.linux-magazine.com/Online/Features/Intrusion-Detection-with-fail2ban

The Author

Chris Binnie is a Cloud Native Security consultant and co-author of the book Cloud Native Security: https://www.amazon.com/Cloud-Native-Security-Chris-Binnie/dp/1119782236.

« Previous 1 2 3 4

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
Print Issues
Digital Issues
 
SUBSCRIPTIONS
Print Subs
Digisubs
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Attacking SSH

    Sometimes the only way to break into an SSH server is through brute force – and yes, there are tools for that.

    more »
  • ShellHub

    ShellHub offers an innovative approach to remote access with minimal reconfiguration of a firewall.

    more »
  • Password Tools

    Create secure passwords with the help of a password generator and check for quality at the same time.

    more »
  • Defending WordPress with WPScan

    The number of potential WordPress vulnerabilities is stunning. WPScan scans your site to find the problems that could lead to compromise.

    more »
  • Secure Online Passwords

    Securely storing passwords online can be a complex task. With a few tools, websites can offer better security, but users still need to choose their passwords wisely.

    more »
comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More

News

Tag Cloud

Administration Community Events Hardware Linux Linux Pro Magazine Mobile Programming Security Software Ubuntu Web Development Windows free software open source