{"id":11779,"date":"2020-09-16T08:56:44","date_gmt":"2020-09-16T04:56:44","guid":{"rendered":"https:\/\/techxmedia.com\/?p=11779"},"modified":"2025-04-16T16:01:50","modified_gmt":"2025-04-16T12:01:50","slug":"how-credential-stuffing-bots-bypass-defenses","status":"publish","type":"post","link":"https:\/\/techxmedia.com\/en\/how-credential-stuffing-bots-bypass-defenses\/","title":{"rendered":"How credential stuffing bots bypass defenses"},"content":{"rendered":"
Raymond Pompon, Director of F5 Labs<\/span><\/h6>\n

In the <\/span>2019 Application Protection report<\/a>, F5<\/a> Labs found a majority (51.8%) of breaches in 2019 were caused by access control attacks. The breaches resulted from stolen login credentials obtained by phishing<\/a> and brute force. Stolen credentials, obtained from other sources, were also prominently used as part of credential stuffing attacks.<\/p>\n

Today, the problem is accentuated by <\/span>a massive proliferation of\u00a0unwanted bots<\/a>. Many can now even evade antibot controls. Here\u2019s what you need to know (and do).<\/p>\n

The Preliminary Credential Stuffing Attack<\/h4>\n

Attackers often employ automation, using bots to launch and orchestrate credential stuffing campaigns. Notable\u00a0point-and-click attack credential tools include Sentry MBA,1<\/a> OpenBullet,2<\/a>\u00a0BlackBullet, Snipr, STORM, and Private Keeper. Attackers also leverage basic open source operational tools like Wget, Selenium, PhantomJS, and cURL to simulate a browser running scripted web login sessions.<\/p>\n

Tapping the Vast Caches of Stolen Credentials<\/h4>\n

To perform a credential stuffing attack, the tool needs a stolen credential list to run against the targeted web login. These credential lists are simply a file of usernames (usually email addresses) and passwords. If the attacker hasn\u2019t already obtained a batch of them through phishing<\/a>, they can easily turn to the dark web. The lists can be loaded right into the\u00a0attack tools.<\/p>\n

Credential Stuffing Causes Outages<\/h4>\n

Many sites often only have a basic web application firewall<\/a> (WAF), or nothing at all. Some WAFs do not detect or defend against credential stuffing attacks. In general, WAFs are designed to block application attacks, malformed requests, and web exploits. A credential stuffing attack looks like a legitimate web login.\u00a0There will be many of them at once, and many with incorrect passwords, so these things can look suspicious. This assumes that the defender is watching their failed login attempts and noting surges. The reality is that credential stuffing is often mistaken for a denial-of-service attack. The login pages then become overwhelmed with failed logins, and either the site crashes or customers can\u2019t get in. There have been cases of backend infrastructure failing under the heavy load of authentication requests.<\/p>\n

Preliminary Credential Stuffing Mitigation Attempts<\/h4>\n

Once an attack is identified, it is time to stem the tide. Some basic defensive measures include inspecting and blocking the web session, which some WAFs can do. If the attack tool or bot uses plain web login requests, then the user agent (used by a web browser to advertise and identify itself to a web server) may be identified as irregular and blocked.<\/p>\n

Another basic defense is using IP address denylists to block the known bad IP addresses. The denylist is often based on simple geographic origins, IP addresses from earlier attacks, or canned third-party reputation lists of known attackers. Another tool is rate limiting<\/a> of login attempts, which unfortunately applies to both attackers and customers. This makes it hard to find the right balance.<\/p>\n

The next step beyond this is to add a CAPTCHA test to the login process. The downside is that CAPTCHAs can annoy customers and can also be a barrier for people with disabilities.<\/p>\n

Attackers Always Retool<\/h4>\n

The cybercrime<\/a> community already knows how to work around these simple defenses. Most of the time, the real work for attackers is configuring and adapting their readily available tools for the specific victim\u2019s website and modifying the scripts.<\/p>\n

Attacker Evasion: Faking the Bot\u2019s Originating Network<\/h4>\n

Attackers rarely use a stable, known set of bots. Once those bots are reputation filtered, they have plenty of other victimized computers and IoT devices for launching attacks. Bots often run on consumer Internet connections, which use dynamic IP addressing that continually changes addresses. Blocking based on geographic origin is also ineffective, as attackers use bots from around the world. Most credential stuffing attack tools have configuration options to load and use new lists of proxies.<\/p>\n

As rate limiting is also often based on the originating IP address, this defensive tool is neutered by bot IP address hopping. Furthermore, attackers can configure their bots to stagger attacks and spread out between addresses. This means bots can come in at different times, from a multitude of places, to slip around rate limiters and IP address blockers.<\/p>\n

Attacker Evasion: Disguising the Bot as a Legitimate Web Browser<\/h4>\n

Many credential stuffing bot tools can imitate\u00a0a real browser. A simple fakeout is to forge a user agent. Bots can also spoof a referrer request header, which identifies the URL linked to the requested webpage. These headers provide a way for websites to loosely check the customer clickstream legitimacy.\u00a0\u00a0Many of these basic techniques can be enough to imitate a customer\u2019s browser and evade basic WAF blocking rules.<\/p>\n

Attacker Evasion:\u00a0Impersonating a Human<\/h4>\n

Naturally, attackers have worked out ways around CAPTCHAs. Many attack tools have optional plugins to match and supply answers for thousands of known CAPTCHA puzzles. F5<\/a> Labs researchers recently wrote a detailed analysis of the CAPTCHA solver market<\/a>, including how CAPTCHAs are often a whack-a-mole response rather than a definitive solution to the problem.<\/p>\n

Attacker Evasion:\u00a0Impersonating Human Mouse Movement<\/h4>\n

Some bot scraping tools look for scripted mouse movements or keystrokes. These too can be spoofed with a wide variety of tools. For example, BezMouse simulates humanlike mouse movements with B\u00e9zier curves to evade antibot\u00a0defenses.<\/p>\n

Look for Smarter Antibot Tools<\/h4>\n

Ultimately, the best defenses against credential stuffing bot attacks need to be sophisticated. It begins with gathering a combination of factors on the web user. These factors are then scored and weighted using machine learning to weed out bots. Intelligent antibot systems can also spot the predictability of pseudorandom mouse and keyboard actions. In addition, they can interrogate the user\u2019s browser during the web session. This interrogation looks for the characteristics of a real browser on an actual computer (such as the ability to run JavaScript). Even the login and password combinations can be examined in real time to check if they are part of known leaked credential databases.<\/p>\n

Bot-driven credential stuffing attacks<\/span> \u2013 especially against weak defenses \u2013 can be relentless and cybercriminals adapt fast. The key is to make it difficult for them, raising the cost and complexity of an onslaught to make\u00a0attacks as undesirable as possible.<\/p>\n","protected":false},"excerpt":{"rendered":"

To perform a credential stuffing attack, the tool needs a stolen credential list to run against the targeted web login. These credential lists are simply a file of usernames (usually email addresses) and passwords. If the attacker hasn\u2019t already obtained a batch of them through phishing, they can easily turn to the dark web. <\/p>\n","protected":false},"author":8,"featured_media":11786,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[9715],"tags":[3436,3433,3432,315,3435,3434,990,2599],"contributor":[],"class_list":["post-11779","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-expert-opinion","tag-antibot","tag-bots","tag-credential-stuffing","tag-cybercrime","tag-data-breaches","tag-f5-labs","tag-phishing","tag-waf"],"featured_image_src":"https:\/\/techxmedia.com\/en\/wp-content\/uploads\/2020\/09\/Raymond-Pompon-Director-of-F5-Labs.jpg","author_info":{"display_name":"Rabab","author_link":"https:\/\/techxmedia.com\/en\/author\/rabab\/"},"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/posts\/11779","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/comments?post=11779"}],"version-history":[{"count":0,"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/posts\/11779\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/media\/11786"}],"wp:attachment":[{"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/media?parent=11779"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/categories?post=11779"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/tags?post=11779"},{"taxonomy":"contributor","embeddable":true,"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/contributor?post=11779"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}