Credential Stuffing

I know that you must get quite tired of hearing about your password. We tell you to keep it strong, use multi-factor authentication, blah blah blah…

We often hear the same kinds of responses back, but it is just my email… I have nothing of interest in there. Yes, we know… and we sympathize. In the end we are just trying to help you. I have had other posts about the significance of strong passwords, I have talked about password lockers/services.

Lets talk about a different direction. Credential stuffing. Now, I am going to admit that the phrase was one that I had seen, but never looked into. As you can imagine, in my role, I encounter a ton of new terms and phrases and often do not have to time to keep up on them all. I will try to do a better job of selecting one and sharing it with you so that you can get nuggets of skills along the way with me.

When we have talked about passwords in the past, I have mentioned that when companies have their networks get breached and data is stolen, sometimes that data is our personal data, but sometimes it is our username and passwords.

Since we on the whole (myself included but I am getting it fixed) are horrible for password reuse, this makes credential stuffing a danger.

So Mr. Blackhat gets their hands on a data dump, they then build a spreadsheet with your email address(es) and the password(s) that you have been known to use. Since the majority of the United States banks at one of a few national banks, they start testing to see if they can log in. if they can… great!

Fortunately banks are getting smarter and are pushing us all to more secure login methods. If you bank is behind the times, AND you use one password all over the internet, you may well become a victim.

I wish I could tell you how many times I have seen “my [social media account] got hacked”. They were probably not hacked at all. they likely either fell for a credential harvester scan, or… were reusing their social media account password on other services that were compromised.

This brings us back to the common pleas of the cybersecurity professionals. Please, PLEASE, use strong and unique passwords and when you are able to, enable multi-factor logins. Yes, it is that important, unless you feel that donating your funds to who knows what country is a suitable form of charity work, one that you cannot even deduct form your taxes.

Why is password re-use a bad thing?

Using the same password across multiple accounts is generally not a good idea for the following reasons:

Security Breaches: If one account gets hacked, the hacker will be able to access all other accounts using the same password.

Lack of Complexity: It is difficult to create a complex password that is unique for each account. Using the same password may mean using a less complex password that is easier for hackers to guess or crack.

Phishing Attacks: Phishing attacks can trick users into revealing their login credentials. If the same password is used across multiple accounts, the hacker can use the stolen credentials to access all the other accounts.

Personal Information: If a password is compromised, a hacker could use personal information from one account to guess the passwords for other accounts.

Compromised Devices: If a device is lost or stolen, a hacker may be able to access all accounts that use the same password.

Overall, using the same password is risky and could lead to a significant compromise of your online security. It’s always recommended to use unique, complex passwords for each account and enable two-factor authentication whenever possible.

Password Security

As I pondered how to best discuss password security, I wondered if I could find a nice history of when passwords came into use and how badly they have been handled over time. Little did I know, we have been quite bad with them since their inception. The resource I found for the subject did such a wonderful job that I am opting instead to wrap his original work into this post. Major credit and props to Troy Hunt for his wonderfully crafted article, https://stealthbits.com/blog/a-history-of-passwords/. I do hope that you will give it a full read and perhaps click on an ad while you are there to show appreciation of his work. I have also been a fan of another piece of his work; https://haveibeenpwned.com/ which is a site that I have used many times. This is a site that will tell you if your email address has been discovered in one of the many multitudes of email/pswd caches out there. If you find your email address is listed there, just reset your password and move on. There is no cause for alarm unless you have that email address tied to something like… your back account. Now if you are one who abuses password by reusing the same one all over, then you may have an issue. If that is the case, then it is time that you start changing up those passwords so that one compromise doesn’t hand over the keys to your email kingdom. Oh I can hear you know… but I don’t have anything worthwhile in my email box, nothing that anyone would find interesting. Sound familiar. think of all of the places that you give your email address to in order to log in or perhaps to verify your existence. How many accounts do you think a black hat hacker could gain control of just by being able to lo into a web mail utility somewhere posing as you with your oh so clever password (yeah Password1)?

Really read Troy’s article, drink it in as it will help you understand why passwords are a bigger deal than you may think. If you want to discuss the topic more, please, drop a comment below. If you liked this article, please come back for more and feel free to mash an ad on your way in or out to help the cause.

Password Reuse and You

We could talk about password strength and safety first, but it is likely that you have heard that time and time again so I will slide that one down the priority list a bit.

There are storehouses of passwords that belong to compromised email addresses. You may have gotten a phishing email that claimed to have your password. One that I have seen provided a somewhat censored version of one of my old passwords.This typically comes with a ransom demand.

The way that these situations happen is the result of human nature. It is all too easy to use the same password on all of your online accounts. They keep increasing the password complexity and there are so many to keep track of.

When a website that you use gets hacked and the username/password database gets stolen that data gets sold off. The majority of Americans bank at one of five major financial institutions. If the criminals have control of your email address (or as we say in the industry, pwns) they can get passwords reset. If they get as far as getting your bank password, where does that leave you? It doesn’t take much imagination to see how bad that can be.

If you have a list of usernames/passwords it is like having a ring of keys. You can do some poking of common email providers and other services to see if those usernames and passwords open the door allowing criminals inside.

Has your email password ever been compromised? Maybe you had to change your email password because you started getting weird email bounceback messages. Would you like to see if your email address has been discovered on a list for sale, or just out for public consumption? Try this link. (I have a few email addresses that have been blown, so don’t feel badly about being listed.)

https://haveibeenpwned.com/Passwords

Where do you go from here? Regardless of being compromised in the past or not, you can help protect yourself from this moment forward by starting to use different passwords for each account. This is where a tool to track your passwords in a secure manner is important. There are many password storage tools out there. Some are subscription based, some are free. This is not an endorsement, but I can say that I have had good experience with Password Safe. Some of the important aspect to consider is that the tool stores your usernames and passwords using encryption, and that the tool is easy for you to use. If it is not easy, you won’t use it.

Please feel free to share your experiences in the comments. Maybe you have a password storage tool that you feel is wonderful, share it with the group. I am always happy to look over new products. Perhaps your input will give the rest of us a better tool to help us in staying safer.

Enjoy the day, and be good to those around you.