Did you know that there is a form of cybercrime that costs businesses millions of dollars each year?
It’s called credential abuse, and it occurs when criminals use stolen usernames and passwords to access company accounts committing account takeover fraud.
Let’s take a look at what credential abuse is and how you can protect your business from it.
The definition of credential abuse
Credential abuse is the unauthorized use of someone else’s credentials, typically a username and password, to gain access to resources or information.
Credential-based attacks can happen in a number of ways. The most common is when hackers use stolen credentials to gain access to an account. They can also use brute force methods to guess passwords, or they can find them in plain text on the dark web.
Why are credential attacks so common in 2023?
It’s no secret that credential abuse is a popular form of cybercrime. Here are a few reasons why:
1. It’s relatively easy for criminals to obtain stolen credentials.
Phishing attacks, data breaches, and malware infections are just a few of the methods attackers use to gain access to personal data.
2. A lot of people use the same password for each account they have.
This makes it easier for criminals to guess passwords and gain access to multiple accounts. (If you’re guilty of using one master password for every login, this is your sign to go change all your passwords ASAP!)
3. Once criminals have stolen credentials, they can use them to access a variety of resources.
For example, they might use the credentials to log in to company accounts, read sensitive emails, or even make unauthorized purchases.
4. Many businesses still don’t have adequate security measures in place to prevent credential abuse.
Not all businesses require two-factor authentication (2FA) for logging into company accounts. 2FA is an essential security measure that limits the potential for unauthorized access.
5. Buying and selling credentials can be lucrative for attackers.
The dark web is riddled with marketplaces for credential abuse. Attackers can sell lists of credentials and earn a profit from them.
How does credential abuse work?
Although each credential-based attack looks different, we’ll share a typical scenario so you can understand the big picture:
1. An attacker obtains a list of credentials.
Here are a few ways attackers can get ahold of your credentials:
- Buying them on the black market. There are underground forums where stolen credentials are bought and sold.
- Finding them in plain sight. If you use the same password for multiple accounts, an attacker who gets hold of that password can try it on other accounts until they find one that works.
- Phishing for them. Phishing is a type of social engineering attack where attackers send emails or texts that look like they’re from a legitimate company, in an attempt to get you to hand over your credentials.
- Using malware. A keylogger is a common form of malware that can capture everything you type, including your passwords.
2. After obtaining credentials, attackers test them on different websites until they find a login that matches.
Credential stuffing is when attackers take a list of stolen credentials and use bots to test the compromised credentials on different websites until they find a match and gain access to an account.
3. Once they’re in, they look for sensitive information like credit card numbers or customer data.
Using the valuable info they find, attackers can steal money, hijack important accounts, or steal identities.
4. They may also plant malware or ransomware so they can come back later and cause more damage.
Attackers can use their access to create new accounts, giving them even more opportunities to commit fraud.
5. If the criminal is feeling really ambitious, they might even try to use these credentials to get into other parts of the company’s network.
This is why it’s so important to have strong security measures in place. Credential abuse can have devastating effects on your business.
The consequences of credential abuse
Credential abuse can have serious consequences for businesses, including:
1. Financial loss
If criminals gain access to your customers’ financial information, they can use it to make unauthorized charges. This can lead to lawsuits and thousands of dollars in losses for your business.
2. Identity theft
Criminals can also use stolen credentials to commit identity theft. This is when someone uses your personal information, like your social security number or driver’s license number, to open new accounts or apply for loans in your name.
The damage from identity theft can be significant, and it can take a long time to recover from it.
3. Reputational damage
When customers’ financial information is stolen, it damages your reputation and makes people lose trust in your business. It can be hard to win back customers after a catastrophic incident like this.
How to prevent credential abuse
Credential-based attacks are nightmares for business owners like you. Thankfully, there are several steps you can take to protect your organization from credential theft:
1. Educate your employees about phishing attacks.
Make sure they know how to spot a phishing email or text and tell them not to click on any links or attachments from people they don’t know.
Run a test by sending a fake phishing email to see if they fall for it. If they do, put them through more training so you can protect the security of your organization.
2. Use two-factor authentication (2FA).
This adds an extra layer of security by requiring users to enter a code from their phone or another device in addition to their password.
Even if criminals have your password, they won’t be able to log in without the 2FA code.
2FA is a simple and effective way to protect your data, and yet too many businesses neglect it. Don’t be the company that falls victim to malware and credential-based attacks.
3. Use strong passwords and change them regularly.
Your passwords should be at least 8 characters long and include a mix of uppercase and lowercase letters, numbers, and symbols.
Avoid using easily guessed words like “password” or your birthdate—and remember, never use the same password for multiple accounts.
We recommend using password manager software to help you keep track of all your logins and keep them secure. After all, who wants to memorize 50 long, incoherent passwords? Nobody does.
4. Monitor your network for suspicious activity.
Keep an eye out for unusual login attempts or devices that shouldn’t be on your network. This can help you catch credential abuse early and stop it before it does too much damage.
5. Implement a data loss prevention (DLP) solution.
DLP can help you keep track of sensitive information, like customer credit card numbers, and make sure it’s not being shared inappropriately.
You can implement DLP by using software that monitors and controls the flow of information in your network.
6. Use CAPTCHA to protect against attacks.
CAPTCHA is a type of challenge-response test that helps to prevent automated attacks. It can be used to protect login forms and other sensitive areas of your website.
It’s important to use CAPTCHA properly, however. If you don’t, you could end up blocking legitimate users. For example, if you use CAPTCHA on a login form, make sure you also have a way for users to reset their password if they can’t pass the CAPTCHA test.
7. Keep your software up to date.
Attackers often exploit security vulnerabilities in outdated software to gain access to systems. By keeping your software up to date, you can make it harder for them to get in.
8. Have a plan for credential abuse incidentals.
No matter how strong your security measures are, there’s always a possibility of credential abuse. That’s why it’s important to have a plan for what to do if it happens.
Make sure you have an incident response team that knows what to do if an attack occurs. You should also have a plan for how you’ll communicate with your customers if their information is compromised.
How you can discover a credential abuse attack
There are a few signs that may indicate you’re under attack:
1. Unusual activity on your network
If you see unexpected devices on your network, it could be a sign that someone is trying to gain unauthorized access. Take action immediately to remove the device and investigate how it got on your network.
2. Suspicious login attempts
If you see login attempts from unexpected locations or devices, it could be a sign of credential abuse. Keep a close eye on login activity and look for any patterns that seem unusual.
3. Increased password reset requests
If you start to get a lot of password reset requests, it could be a sign that someone is trying to guess your employees’ passwords.
4. Phishing emails
If you or your employees receive phishing emails, it’s a sign that attackers are trying to collect credentials.
Phishing emails often look like they’re from a legitimate company or website. They may include links or attachments that, if clicked, will install malware or take you to a fake website where you’re asked to enter your login information.
5. Increased customer support requests
If you start to get more customer support requests than usual, it could be a sign that something is wrong. Customers may be having trouble logging in or may be worried about their information being compromised.
6. Unexplained financial losses
Financial losses might look like unauthorized charges on your credit card or strange activity in your bank account. If you see anything unusual, it could be a sign of credential abuse.
If you notice any of these things, it’s important to investigate right away. The sooner you discover an attack, the easier it will be to stop it and limit the damage.
How to respond to a credential abuse attack
If you think you’re under attack, there are a few things you can do to react:
1. Isolate the affected systems.
If you think your systems have been compromised, it’s important to isolate them right away to prevent the attacker from doing more damage. Disconnect any affected devices from the network and disable any accounts that have been compromised.
2. Change all your passwords.
Once you’ve isolated the affected systems, change all your passwords immediately. This includes your website password, admin password, email password, and any other passwords you use. (See, this is where that password manager will come in handy!)
3. Notify your customers.
If customer information has been compromised, it’s important to let them know as soon as possible. Then, they can take steps to protect themselves, such as changing their passwords.
It’s never fun to notify customers that their information has been compromised. However, it’s important to be open and honest with them. The sooner you let them know, the better.
Transparency will help you protect the reputation of your organization, even in the horrific event of a credential-based attack.
4. Contact law enforcement.
If you think you’ve been the victim of a credential abuse attack, it’s important to contact law enforcement. They can help you investigate the attack and may be able to track down the attacker.
5. Review your security measures.
After an attack, it’s a good idea to review your security measures to see if there are any ways you can improve them. This will help you prevent future attacks and keep your systems safe.
Kasada offers comprehensive protection from credential stuffing and automated threats.
Credential abuse is a serious threat to businesses of all sizes. By taking steps to prevent it, you can protect your customers and your organization as a whole.
Kasada is a security company that specializes in protecting businesses from credential abuse. We defend web, mobile, and API channels against:
1. Denial of service (DoS)
Don’t let bot traffic and DDoS attacks put your servers at risk.
2. Content scraping
No more stolen online assets! We’ll stop bots from extracting data from your HTML and APIs.
3. Account takeover
We prevent credential stuffing and lower the risk of fraud by stopping attackers from gaining access to the accounts on your network.
4. System takeover
We’ll stop bots from scanning your site to prevent them from discovering coding weaknesses that could let attackers in.
If you think your business might be at risk of credential abuse, contact us to learn how we can help you secure your data (and your peace of mind).
