diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Compromised credentials are a threat to your business and customers. Here’s how to reduce the risk.

Credential stuffing is a type of cyberattack in which a cybercriminal uses stolen usernames and passwords from one organization (obtained in a breach or purchased off of the dark web) to access user accounts at another organization.

Credential stuffing attacks are one of the most common causes of data breaches because[ 64% of all people](https://f.hubspotusercontent20.net/hubfs/3791228/2022%20SpyCloud%20Annual%20Identity%20Exposure%20Report.pdf) reuse the same password on multiple (and sometimes all) accounts. In fact, on Auth0's platform alone,[ nearly half of all login requests](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) we receive each day are attempts at credential stuffing.

The opportunity for cybercriminals to use credential stuffing is only growing as more credentials are exposed through breaches; at present, literally billions of compromised credentials are circulating on the dark web. 

However, credential stuffing attacks are preventable if you implement the right cybersecurity measures. Below is what executives need to know about credential stuffing attacks and what can be done to reduce or prevent the likelihood that their organizations will be a victim of one.

> More in the following:
>
> - **[Credential stuffing whitepaper](https://auth0.com/resources/whitepapers/credential-stuffing-attacks)**
> - **[What is broken authentication](https://auth0.com/blog/what-is-broken-authentication/)**

## How Credential Stuffing Works

To execute a credential stuffing attack, cybercriminals add a list of stolen username and password pairs to a botnet that automates the process of trying those credentials on multiple sites at once. Large-scale botnet attacks can overwhelm a business' IT infrastructure, with websites experiencing as much as[ 180 times](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) their typical traffic during an attack.

![Anatomy Credential Stuffing](https://images.ctfassets.net/23aumh6u8s0i/ohyMA4nbwQgkGF77RnSOs/b8997e017022790f156a985fb97c375d/anatomy-credential-stuffing.jpg)

Once cybercriminals find a site where a set of credentials works, they’ll have access to a user's account and personal data to do with as they please, which most commonly includes:

* **Selling access to compromised accounts:** This is particularly common for media streaming services. [Disney+](https://www.cpomagazine.com/cyber-security/new-disney-plus-streaming-service-hit-by-credential-stuffing-cyber-attack/),[ Netflix, and Spotify](https://www.engadget.com/2019/03/13/wickedgen-admin-arrested-stolen-passwords-netflix-spotif/) have all been victims of attacks in which hackers sold access to user accounts for less than the cost of a subscription.
* **E-commerce fraud:** Hackers can impersonate legitimate users at retailers' websites and order a high-value product, either for their own use or for reselling. This is a common (and for criminals, potentially lucrative) form of identity theft, which makes retail the most vulnerable vertical for credential stuffing, according to[ research from Akamai](https://www.akamai.com/newsroom/press-release/akamai-research-commerce-remains-top-target-with-over-14-billion-web-application-and-api-attacks).
* **Corporate/institutional espionage and theft:** While the above crimes have serious consequences for companies and their customers, this third form of attack has the potential to be most devastating for businesses. If an attacker successfully hijacks the account of an employee or admin, they could gain access to all sorts of sensitive personal information, like credit card numbers, social security numbers, addresses, and login credentials as well, all of which they can sell to the highest bidder.

## The Costs of Credential Stuffing Attacks

Although credential stuffing attacks often have a low success rate ([usually one to three percent](https://www.recordedfuture.com/credential-stuffing-attacks/)), their impact on organizations is often anything but small.

For example, the Ponemon Institute's ["Cost of Credential Stuffing" report](https://library.idgcommunications.net/idgcampaigns/documents/uploaded_data/d40/97b/1c-/original/the-cost-of-credential-stuffing_EN.pdf) found that businesses lose an average of $6 million per year to credential stuffing in the form of application downtime, lost customers, and increased IT costs.

Increasingly, regulators, as well as the public, are also holding companies accountable for credential stuffing attacks with stiff fines. Companies may be subject to legal action under data privacy laws such as [GDPR](https://auth0.com/docs/compliance/gdpr) if they fail to implement adequate security measures to prevent such attacks, fail to inform the public of a breach, or don't do enough to protect passwords.

For example, in 2018, the UK's [Information Commissioner's Office (ICO) fined Uber](https://www.computerweekly.com/news/252453244/ICO-fines-Uber-385000-for-data-protection-failings) £385,000 for "a series of avoidable data security flaws" that exposed the data of approximately 2.7 million UK customers. And in 2021, the French Data Protection Authority (CNIL) fined a data controller and its data processor €225,000 “for failure to implement adequate security measures to protect customers’ personal data against credential stuffing attacks on the website of the data controller.”

## Credential Stuffing Attacks vs. Brute Force Attacks

Credential stuffing is considered a type of brute force cyberattack. But in practice, the two are very different, as are the best ways to secure your systems against them.

Brute force attacks attempt to guess passwords by changing the characters and numbers (often in prescribed patterns or with commonly used base password phrases). To protect against them, you can limit the number of failed login attempts with[ brute force protection](https://auth0.com/docs/attack-protection/brute-force-protection), use a CAPTCHA, or require your users to use a stronger password.

However, a strong password won’t stop a cybercriminal from gaining access to an account via credential stuffing because the password is already known. Even CAPTCHA's or brute force protection’s ability to protect users is limited since users often[ change their passwords in predictable patterns](https://www.sans.org/security-awareness-training/blog/time-password-expiration-die) and cybercriminals have a breached password to iterate from.

## How to Prevent Credential Stuffing Attacks

Most people know password reuse is unsafe but choose to use the same password on multiple sites anyway because they have roughly[ 100 passwords to remember](https://tech.co/news/average-person-100-passwords). Password managers are an option, but [adoption rates are low](https://www.security.org/digital-safety/password-manager-annual-report/). So to prevent credential stuffing attacks, it’s up to organizations to take measures — such as removing passwords altogether — to ensure cybercriminals can’t use stolen credentials to access their users’ accounts. Based on [OWASP's Credential Stuffing Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html), below are several methods for doing so.

### Credential hashing

Credential hashing is the first step to protecting your user's credentials from theft. [Hashing](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/) scrambles a user's password before you store it in your database so that in the event that it is stolen, a hacker won’t be able to use them (in theory, at least).

In practice, not all password hashing is uncrackable. As Rick Redman, a penetration tester at KoreLogic, [explains](https://www.wired.com/2016/06/hacker-lexicon-password-hashing/), “The strength of the hash is the insurance policy. It tells you how much time users have to change their passwords after a data breach before they come to harm... If it’s just SHA1, there is no window... If it’s bcrypt, you have time to run away and change all your passwords.”

So although hashing user passwords won’t prevent a credential stuffing attack, it will limit what a cybercriminal can do with those passwords once they’ve stolen them.

### Breached password protection

Breached password protection compares the password a person uses to log in against databases of compromised credentials (like[ haveibeenpwned](https://haveibeenpwned.com/)) to prevent credential stuffing in real-time. 

For example,[ Auth0's breached password detection](https://auth0.com/docs/attack-protection/breached-password-detection) can be configured to notify a user, block them from logging in, or request an additional authentication factor (MFA) if it suspects their credentials were part of a published security breach or if a login attempt came from a suspicious IP address.

### Bot detection

As mentioned earlier, attackers use bots to execute a credential stuffing attack. [Auth0's bot detection](https://auth0.com/docs/secure/attack-protection/bot-detection) feature is able to identify a bot attempting to authenticate with [a high percentage of success](https://auth0.com/blog/auth0-bot-detection-reduces-bot-attacks-by-79/). It provides protection against credential stuffing attacks with very little friction to legitimate users. When a bot attack is detected, it displays a CAPTCHA step in the login experience to eliminate bot and scripted traffic.

### Anomaly detection

Monitoring what is happening is always a good approach to intervene earliest and stop an attack. If you have visibility of your traffic, you can understand when you are under attack, and you can take action to mitigate attacks. In Auth0, you can use [Log Streams](https://auth0.com/docs/customize/log-streams) to monitor your traffic in near real-time. After creating and configuring a Log Stream, you will start seeing Auth0 events being ingested into your chosen monitoring service. Based on your monitoring service, you can build your anomaly detection dashboard by anayzing the [Attack Protection Log Events](https://auth0.com/docs/secure/attack-protection/view-attack-protection-events).

### Multi-Factor Authentication (MFA)

[Multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication) is a highly effective way to prevent credential stuffing because it requires users to log in with another form of authentication in addition to a username-password combination. For example, this could mean biometric authentication such as a fingerprint, a one-time code sent to a device associated with the user, or an email sent to a secured account — none of which a cybercriminal will have access to.

Although the adoption of MFA has been slow due to concerns about its impact on customer experience, the increase in sophistication and customizability of MFA are helping it catch on. For instance, in February 2020,[ Google announced](https://siliconangle.com/2020/02/12/google-require-nest-users-use-two-factor-authentication-enhanced-security/) it would require Nest smart home users to use two-factor authentication.

### Continuous authentication

Continuous authentication systems use factors like biometrics or behavioral patterns to verify a user’s identity in real-time (while they use an application) instead of a password. As a result, credential stuffing attacks (as well as a number of other cyberattacks) are no longer a viable method for cybercriminals to gain unauthorized access to a user’s account.

### Passwordless authentication

[Passwordless authentication](https://auth0.com/passwordless/) can prevent credential stuffing altogether because it verifies a user with something they have (a device or another account) or something they are (biometrics) instead of a password (something they know).[ Passwordless](https://auth0.com/passwordless/) also creates a better login experience for users and saves organizations time and money from dealing with password resets.

## Passwordless Authentication Is Better for Businesses and Users

Not only does passwordless authentication eliminate credential stuffing attacks, but numerous studies and reports show that it is a[ more secure](https://auth0.com/blog/is-passwordless-authentication-more-secure-than-passwords/),[ more user-friendly](https://www.lastpass.com/solutions/passwordless-access/from-passwords-to-passwordless), and[ more cost-effective](https://www.weforum.org/press/2020/01/forgotten-your-password-not-having-one-will-make-you-safer-says-world-economic-forum) solution overall than traditional username-password authentication for both businesses and their users.

“Relying on passwords as the primary means for authentication no longer provides the security or user experience that consumers demand,” Andrew Shikiar, Executive Director of the FIDO Alliance, [explains](https://www.weforum.org/press/2020/01/forgotten-your-password-not-having-one-will-make-you-safer-says-world-economic-forum) in a joint report with the World Economic Forum. Adrien Ogee, Project Lead from the World Economic Forum, adds, “Better authentication practices are not just possible; they are a necessity.”

Auth0’s platform makes it easy to implement secure, user-friendly passwordless authentication using biometrics, social logins, and more. Learn how to eliminate the risks associated with traditional username and password authentication with Auth0’s Passwordless authentication platform[ here](https://auth0.com/passwordless/).

What Is Credential Stuffing? How To Prevent Credential Stuffing Attacks

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

New feature blocks majority of malicious requests, saving enterprises critical time and resources



**BELLEVUE, Wash. &mdash; August 18, 2020 &mdash;** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today launched [Bot Detection](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks), a new security feature that reduces the effectiveness of a credential stuffing attack by as much as 85%, with minimal impact on user experience. Bot Detection is a powerful addition to the company’s expanding security portfolio, and works in tandem with Auth0 Breached Password Detection, Brute Force Protection, and Multi-factor Authentication, to provide extensive mitigation against a variety of sophisticated threats, including automated attacks, account takeovers, phishing attacks, and more.

Credential stuffing attacks often rely on stolen account credentials (username and password) from a previous data breach, and are used to gain unauthorized access to user accounts on another website. This is executed via large-scale bot-driven attacks against the login flow and is an increasingly pervasive problem for enterprises. Ongoing Auth0 customer analysis revealed the following: 

* Auth0 sees an average of 175,000 unique IP addresses that are deemed suspicious on a daily basis. 
* Threat actors can use as many as 65,000 IP addresses for a single attack.
* During an attack, credential stuffing can account for as much as 65% of the traffic to Auth0’s authentication service.
* During a credential stuffing attack, traffic for a particular website may surge as much as 180x the usual volume, with traffic related to the attack itself accounting for 90% of overall activity. 

Bot Detection correlates numerous data sources to identify and mitigate bot-driven attacks before login, and relies on a collection of risk signals and assessors that identify indicators of suspicious activity. This layered approach — also known as defense in depth — consists of multiple security capabilities, including Bot Detection, that effectively reduce the number of credential stuffing attempts and many other attacks. At a high level, Bot Detection monitors IP addresses for non-suspicious events, such as successful logins; suspicious events, such as numerous failed login attempts across multiple accounts; and IP reputation data, which is used to identify known threat actors. When suspicious traffic is detected, a CAPTCHA step is required to complete a login request — the system is designed to mitigate the majority of bot attacks targeting the login or registration flow. At launch, Auth0 will support customers using its [Universal Login](https://auth0.com/blog/introducing-the-new-auth0-universal-login-experience/) capabilities, with additional support for other experiences in the coming months. 

Automated attacks are growing more sophisticated each day, and these large-scale bots are designed to respond to any and all controls to evade detection. Auth0 found that threat actors can, and do, change their attack strategies in as little as five minutes to bypass a security control. More than [80% of companies](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) state it is difficult to detect, fix, or remediate [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/), which result in an average of more than $6 million a year in costs per company and can cause a significant impact on IT resources, account takeovers, and brand reputation. 

“We’ve seen an increase in the volume and sophistication of bot attacks over the last few years, and companies are investing more in their defenses,” said Matias Woloski, CTO and cofounder at Auth0. “Being at the front door of applications with a service that secures more than 4.5 billion login transactions per month, we have a unique vantage point for quickly identifying and blocking suspicious activity before any damage is done. This is what makes Bot Detection very effective at preventing account takeover and reducing the load on DevOps and SecOps teams.” 

More detailed information on credential stuffing can be found here: [Credential Stuffing Attacks: What Are They and How to Combat Them](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) (whitepaper), and [Reducing the Impact of Credential Stuffing](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks) (blog post). 

<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk <br />
Auth0 Global Communications<br />
[press@auth0.com](mailto:press@auth0.com)<br />

Hannah Carroll<br />
Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />


New Bot Detection Feature by Auth0 Reduces Effectiveness of Credential Stuffing Attacks by Up to 85%

antoniofuentes

Antonio is a Product Manager in charge of features and functions used by thousands of customers implementing identity systems to keep their users safe and prevent malicious activity.

Product Manager, Continuous Auth

Antonio Fuentes

How Auth0 uses risk signals to detect and help you manage scripted, high-volume attacks on your identity flows



## The Problem

Attacks on an identity infrastructure using stolen credentials are a difficult problem to solve. [Credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/) occur when a bad actor sends scripted, automated login attempts to an application or website in extremely high volumes, with the objective of gaining access to user accounts. This is an increasingly common problem: on any given day, up to 69% of login attempts on the Auth0 infrastructure are suspected to have originated from credential stuffing attacks. 

This type of attack can be quite sophisticated. Sometimes they come in the form of hundreds of thousands of login requests to a site in a short time window, at a very high velocity, and from a relatively small number of IP addresses from unusual locations. They can also come in the form of scripts that send traffic using tactics to dynamically evolve their velocity, location, and number of IP addresses to avoid detection.  

Generally, solving this problem involves a tradeoff between usability and security, in which user experience pays the price. Measures like multi-factor authentication (MFA) are effective in limiting the success rates for a script involved in a credential stuffing attack, but they also add friction for legitimate users. 

To tip the scale in favor of user experience, malicious bots and scripts need to be detected and rejected before a login call is even processed by the authentication server. Doing so enables you to limit the impact of credential stuffing attacks while delivering a better experience for the end user. 

## Bot Detection from Auth0

Auth0 is launching Bot Detection, the first in a series of features to detect credential stuffing attacks on the login flow. Once enabled, this feature will use a variety of signals to assess the likelihood that a login call originates from a scripted attack. If the risk assessment is high, a CAPTCHA step is inserted into the login flow. 

![Bot Detection](https://images.ctfassets.net/23aumh6u8s0i/3Fs7MAvNuLZTFJ20QOSw6m/63bf1b065314dd2bea4a7451782dfb6b/bot-detection-anomaly)

Bot Detection will be supported at launch with Auth0’s Universal Login experience. For customers who have built more customized user experiences using native SDKs such as `lock.js` and mobile SDKs such as a `lock.Android` and `lock.swift`, Auth0 will support an exception scenario so that customers can recognize a risky call and take steps to render a CAPTCHA step on the screen. The feature will also support presenting CAPTCHA using a generic flow or a customer’s own Google reCAPTCHA.

<table>
<tbody>
<tr>
<td><img src="https://images.ctfassets.net/23aumh6u8s0i/1sos7fOgZYGp148983HyH5/809ea54d105104de83c2e922fe22de7f/bot-captcha" alt="Bot Detection-1" width="396" height="602"/></td>
<td><img src="https://images.ctfassets.net/23aumh6u8s0i/1U3FsuEZ0rHL9kDNQv17J5/cb207f20b5eb8b676f1b2549866456dd/bot-captcha-2" alt="Bot Detection-2" width="382" height="735"/></td>
</tr>
</tbody>
</table>

## Mitigating Abuse with Auth0

Bot Detection will be the latest addition to Auth0’s collection of features designed to prevent abuse, including [Breached Password Detection](https://auth0.com/docs/anomaly-detection/breached-password-security), [Brute Force Protection](https://auth0.com/docs/anomaly-detection/brute-force-protection), and [MFA](https://auth0.com/docs/mfa). These features help customers mitigate the tradeoffs between security and usability without unnecessary compromises to user experience. 

## Learn More

* [Credential Stuffing Attacks: What They Are and How to Combat Them](https://auth0.com/resources/whitepapers/credential-stuffing-attacks)
* [The Anatomy of a Credential Stuffing Attack](https://auth0.com/resources/webinars/credential-stuffing-attack-webinar)

Auth0 is the first identity management platform for application builders, and the only identity solution needed for custom-built applications. With a mission to secure the world’s identities so innovators can innovate, Auth0 provides the simplicity, extensibility, and expertise to scale and protect identities in any application, for any audience. Auth0 secures more than 100 million logins each day, giving enterprises the confidence to deliver trusted and elegant digital experiences to their customers around the world.
<include src="asides/AboutAuth0" />


Reducing the Impact of Credential Stuffing Attacks

5e074956ee8ba1fea26e30d28c190495?s=300 avatar

5e074956ee8ba1fea26e30d28c190495?s=300

Full stack developer creating content at Auth0. I love taking a deep dive into hard-to-understand concepts and creating content that makes them easier to grasp. In my free time you can usually find me reading, hanging out with my dogs, or curling in the squat rack.

Former Developer Content Manager

Holly Guevara

Learn how to prevent common vulnerabilities such as XSS, injection, and third-party vulnerabilities

Developer's Guide to Common Vulnerabilities and How to Prevent Them

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Why credential stuffing, more data privacy regulation, and record attacks will require ‘old-fashioned’ work.



[2019 set a record for data breaches](https://www.darkreading.com/attacks-breaches/2019-trending-as-worst-year-on-record-for-data-breaches/d/d-id/1336348). Add in [rising ransomware attacks](https://www.cnn.com/2019/10/08/business/ransomware-attacks-trnd/index.html) an increasing number of data privacy regulations like CCPA and India’s upcoming data privacy act are forcing a convergence of security and compliance. 

I sat down with Auth0’s Chief Security Officer Joan D. Pepin and Senior Director of Security and Compliance Duncan Godfrey to discuss what we can expect in 2020.

## 1. Credential Stuffing Continues to be the ‘Easy Attack’

[Credential stuffing attacks](https://auth0.com/blog/the-disney-credential-stuffing-attack-could-happen-to-you/), where hackers steal login credentials from one site and then use the same credentials to break into a user’s other accounts, will continue to be the ‘easiest attack on the internet’ says Joan. 

“Millions of usernames and passwords have already been breached,” says Joan. “And most people use the same password for everything. These credentials are available for free or cheap and what’s inside people’s accounts has real value. Add up bad behavior + breaches + value and you get the easiest attack on the internet. At Auth0, we detect [50,000 attacks every day](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) from unique IP addresses.” 

<include src="TweetQuote" quoteText="Find out why @CloudCISO_Joan expects credential stuffing attacks to continue in 2020 — and what you can do about it. #2020prediction #cybersecurity"/>

Joan says companies can help mitigate this global challenge by:
> * Doing what they can to make sure their customers’ credentials aren’t breached (and become part of the problem)
> * Employing solutions that will inform their users that they are using breached credentials
> * Make it easy for users to change their credentials
> * Consider bringing back the 90-day password change policy
> * As an industry, we need to collectively work on a solution that’s better than passwords

## 2. AI Loses its ‘Hollywood’ Shine

2020 will be the year that the cybersecurity industry pulls a reverse [Terminator](https://www.imdb.com/title/tt0088247/) as we see AI-focused detection products losing their shine because of their inability to meet silver bullet promises says Duncan.

“Currently, the term AI is being used as a catch-all for distinct technologies,” says Duncan. “When people think about AI, they think of movies like the [Terminator](https://www.imdb.com/title/tt0088247/) or [Minority Report](https://www.imdb.com/title/tt0181689/). But when people use AI security products, they’re often actually using machine learning algorithms rather than a prescient computer. Many cybersecurity products carry the AI label, but just can’t deliver that Hollywood performance.”

Despite all the marketing hype, AI still isn’t delivering, says Duncan. 

<include src="TweetQuote" quoteText="Sr. Director of Security and Compliance.@duncangodfrey predicts Cybersecurity AI will lose its shine in 2020. Do you agree? #2020prediction #cybersecurity"/>

“There are no shortcuts in security. It’s still based on doing the hard foundation work and being rigorous with your security hygiene. AI is solving high-level problems that are beyond the needs of most companies. I’m not saying all this technology isn’t working: we have seen great strides in content and facial recognition for example. ”

But it won’t be this way forever. “in 50 years this prediction will perhaps make me look like a Luddite but whatever tech we are using then will be built out of the ashes of the broken AI tech of the last few years — as in I might hear it tell me ‘I will be back,” says Duncan.

## 3. The Buck Stops at CCPA

GDPR was a game-changer for many, but some companies didn’t have to put their data houses in order. Joan says she expects [California Consumer Protection Act (CCPA)](https://auth0.com/ccpa/) to have a bigger impact. “Companies that were able to skate on GDPR will have to deal with CCPA — and because these companies weren’t large enough to be impacted by the EU’s regulations, they are likely to be smaller and less prepared, or we may see CCPA cause more pain than GDPR.”

## 4. What’s Under the Hood? Autonomous Vehicle Attacks Increase

[Falling asleep behind the wheel](https://arstechnica.com/cars/2019/06/people-keep-spotting-teslas-on-the-freeway-with-snoozing-drivers/) of your self-driving Tesla seems like a fairly safe activity until you look under the cybersecurity hood says Duncan. 

“We have become more and more dependent on automated driving systems and now we are seeing active testing of fully autonomous vehicles. Behind all of this technology are management and control networks operated by the manufacturer. As this technology pervades through our lives it makes you wonder how secure they are. This year [84% of automotive engineers](https://auth0.com/blog/car-hacking-and-cybersecurity-in-automotive-industry/) expressed concern that their systems weren’t keeping pace. We’ve already seen small-scale hacks on vehicles, but what happens if a control network is compromised and thousands or tens of thousands are hacked at the same time? These networks become part of our critical national infrastructure and in the same way, power grids and our telecommunications networks are vulnerable, we have a whole new class of social infrastructure that needs protecting. I expect we’ll see an increase in targeted individuals or even fleets of cars. As we become aware of the challenges, companies should take steps to secure their systems and demonstrate to society and their customers that they’re taking this seriously.”

## 5. Cybersecurity Will Require ‘Old-Fashioned Work’

Privacy regulations like GDPR and CCPA are driving the convergence of security and compliance, says Joan. But the solution doesn’t reside in the next-best cyber tool. 

“Be thoughtful,” says Joan. 

“Just like your finance team should have a really good idea of your company's assets and liabilities, the InfoSec team, your data team  — whoever is responsible — should understand your data assets and liabilities. If responsibility is unclearly spread across six teams that’s the first place to be thoughtful. Do the work of noting your assets and liabilities. Do you have a Plan? Who owns it? Which laws, regs, norms, best practices you are following (and not following). What would be easy to fix? What would be hard? This is old-fashioned work. Nothing cyber about it. Your CFO, CISO, Chief Privacy Officer, Chief Data Officer — someone should own this project, make an inventory, have a plan — and anyone who says the word “cyber” should have to put a dollar in the jar. There’s nothing cyber about it.”

## 6. Expect even more information warfare

We promised you five predictions, but couldn’t this one out. You’ll find Joan’s thoughts on the relationship between information warfare and cyber warfare in this [Forbes](https://www.forbes.com/sites/gilpress/2019/12/12/42-more-cybersecurity-predictions-for-2020/#8b57cd54a56b) post. We’ll get deeper in a future post.


Top 5 Cybersecurity Predictions for 2020

Breached Password Detection and Multifactor Authentication Critical for Prevention



**BELLEVUE, Wash., November 18, 2019 —** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today revealed data insights showing the staggering amount of credential stuffing attacks attempted on its platform on a daily basis. Auth0 detects attacks from more than 50,000 unique IP addresses every day, reflecting the growing sophistication and frequency of cybercrime. Credential stuffing attempts are constantly multiplying, with absolutely no slowdown in sight.

The sheer number of attempts is due largely to the ease and inexpensive manner in which credential stuffing attacks can be orchestrated. Getting access to breached passwords is the first step for attackers, and unfortunately, there are billions openly available on the internet. Auth0's database contains more than one billion breached email/password combinations which are used for its [Breached Password Detection](https://auth0.com/breached-passwords) feature, the first line of defense against credential stuffing. Breached credentials, in combination with 65% of people [reusing passwords across accounts](https://services.google.com/fh/files/blogs/google_security_infographic.pdf) (Google), enables hackers to architect botnets — networks of exploited devices — to direct large-scale attacks in a coordinated manner.

Whereas targeted attacks have a specific and designated entry in mind, large-scale attacks like credential stuffing are automated and intended to attack as many entry points as possible. There is also a proliferation of 'botnets-for-hire' where services are traded among hackers, even rented for nominal fees for use in widespread attacks. And their destruction can oftentimes go unnoticed because these botnets steal insignificant amounts of money from services (like Spotify or Netflix) that actually add up to billions of dollars every year.

Between July and September 2019 alone, Auth0 determined that during a credential stuffing attack, traffic for a particular website may surge as much as 180x the usual volume, with traffic related to the attack itself accounting for 70% of overall activity.

"Unfortunately, it has become very easy and cheap for bad actors to quickly rotate the IP addresses used in an attack. Nearly all of the attacks we detect appear to originate from botnets," said Matias Woloski, CTO and co-founder of Auth0. "Many major brands have fallen victim to credential stuffing attacks this year — causing a significant impact on IT resources, account takeovers, and brand reputation. Even the largest companies are vulnerable if they don't have the right preventative measures in place." 

Auth0 is at the front door to stop credential stuffing attacks. [Breached Password Detection](https://auth0.com/breached-passwords) (part of Auth0's [Anomaly Detection](https://auth0.com/learn/anomaly-detection/)), with its internal database of more than one billion breached passwords, enables customers to block user accounts that try to login with compromised information, and only grants access when the password has been reset. This is instrumental in blocking credential stuffing attacks, since hackers rely on people reusing email and password combinations that have already been breached.  

In addition, [Multifactor Authentication](https://auth0.com/multifactor-authentication) (MFA) is one of the best ways to prevent account takeovers, whether from a credential stuffing attack or something else. In order to compromise an MFA-protected account, attackers would need to access not only a set of breached credentials used across accounts, but also the device used for the second factor. Combatting MFA drastically increases the time and effort needed for bad actors to compromise an account, which makes it infeasible to do at scale. Auth0 is working on additional features to reduce the perceived friction end users experience when MFA is implemented.

"Breached Password Detection and MFA functionality are the critical barriers for preventing credential stuffing attacks. We are continuously improving our features to detect and prevent, and will be rolling out new functionality to have even greater visibility into attacks," added Woloski.

<include src="asides/AboutAuth0" />

### Media Contacts

Alex Plew <br>
Matter for Auth0 <br>
auth0@matternow.com <br>

Deepika Zafar <br>
Racepoint Global for Auth0, EMEA <br>
auth0@racepointglobal.com


Auth0 Reveals 50,000 Unique IP Addresses Make Credential Stuffing Attempts on Daily Basis

duncan-godfrey

Duncan is a security, engineering, and business leader. His background is in security engineering and, in particular, cloud security.

Sr. Director of Security and Compliance

Duncan Godfrey

How Breached Password Detection and MFA Can Help Ward Off the Millions of Attempts Botnets Make Each Month



**TL;DR:** Credential stuffing can threaten user accounts and service availability. Security expert Duncan Godfrey shows how Auth0 defends customers with breached password protection.

Anyone operating a web application which authenticates users will know credential stuffing attacks all too well. It’s a constant hum of bots knocking on your infrastructure trying to take over user accounts. [_OWASP_](https://www.owasp.org/index.php/Credential_stuffing) defines it as _"the automated injection of breached username/password pairs in order to fraudulently gain access to user accounts."_

Credential stuffing is an efficient type of brute force attack which uses the vast amount of available breached user credentials to exploit the still all too often story of users reusing their passwords across different services.

The most recent [_Akamai State of the Internet Report_](https://www.akamai.com/us/en/about/our-thinking/state-of-the-internet-report/global-state-of-the-internet-security-ddos-attack-reports.jsp) focuses on credential stuffing and gives some insight into the scale of the problem — between May to June 2018 they recorded 8.35 million credential stuffing attempts. It brings into focus the dire state of using passwords as a single authentication factor in 2018. As Auth0 handles authentication for our customers, we find ourselves at the epicenter of these kinds of attacks.

<include src="TweetQuote" quoteText="@akamai_soti reported 8.35M credential stuffing reports in a single month. Security expert @duncangodfrey shares how to protect your customers with the help of @auth0."/>

On particularly busy days at Auth0, we will detect up to 600K logins being made with known breached passwords. The attacks are not always random and are often targeted against companies whose customers resources can be drained or where access to the account itself can be sold (i.e. it gives access to premium content).

## Defending Credential Stuffing with Breached Password Detection

In response to the growth of credential stuffing attacks, we developed the [_breached password detection_](https://auth0.com/breached-passwords) service to help our customers defend their users. Once enabled, the service will monitor for logins using known compromised credentials and can be set to lock out that user until they have reset their password.

<AmpContent>
<amp-video controls
  layout="responsive"
  width="480" height="270">
  <source src="https://embed-ssl.wistia.com/deliveries/2c40154d519f5fb3713c1f64f80f20625c89ba3e/breached-video.mp4"
    type="video/webm" />
</amp-video>

</AmpContent>

<NonAmpContent>

<video controls="controls">
  <source src="https://embed-ssl.wistia.com/deliveries/2c40154d519f5fb3713c1f64f80f20625c89ba3e/breached-video.mp4">
   Your browser doesn't support HTML5 video. Here is a <a href="https://embed-ssl.wistia.com/deliveries/2c40154d519f5fb3713c1f64f80f20625c89ba3e/breached-video.mp4"> breached password detection</a> instead.
</video>

</NonAmpContent>

The botnets that carry out these attacks not only threaten our customers’ accounts but they are a threat to the availability of our service. An attacker can slowly try the credentials aiming to avoid detection or they can burst attempts using all their capacity to test credentials as quickly as possible. When that happens it is effectively a DDoS attack — so we have to proactively manage our capacity, scaling, and rate limiting to protect our customers and our infrastructure.

![Auth0 Anomaly Detection](https://images.ctfassets.net/23aumh6u8s0i/BScpkuG04n0rMk2kj9s1s/5d8901f8d17cddabd600fcfb50e247d7/Auth0-Anomaly-Detection)

> Auth0 maintains a continuously-updated collection of breached credentials, with hundreds of millions of entries. All password-based login attempts are checked against this database, and any matches are blocked in real-time. [Auth0 offers a **free tier**](https://auth0.com/pricing) to get started with modern authentication. Check it out, or <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account here</a>!

## FTC: "Innocent Corporate Victim" No Defense

Credential stuffing is also a developing legal threat to companies who hold sensitive data for their customers. The Federal Trade Commission (FTC) [_recently took action against online tax preparer TaxSlayer_](https://www.ftc.gov/news-events/press-releases/2017/08/operator-online-tax-preparation-service-agrees-settle-ftc-charges) because they were leaving customer data open to credential stuffing, going so far as to state that being an “innocent corporate victim” was no defense in an enforcement case. Rather, in the FTC’s view companies holding sensitive customer information should be taking proactive action to reduce the risk of credential stuffing.

There are things which can be done now to reduce the risk of automated attacks. Firstly, they are not effective against logins protected with [_MFA_](https://auth0.com/docs/multifactor-authentication). Authenticating with two factors should be considered a minimum good practice for protecting your users. The TaxSlayer attack was halted when the company implemented MFA.

Educating your users against reusing their passwords and helping them to improve their password hygiene can help protect your users and your business. Password management apps like [_1Password_](https://1password.com/) or [_lastpass_](https://www.lastpass.com/business-password-manager) make maintaining a unique password for all your accounts more manageable.

<include src="TweetQuote" quoteText="Automated cyber attacks can be overwhelming. Protect your customers with tips from @auth0 security expert @duncangodfrey."/>

The reality is that right now it’s just too simple for attackers. This is an Internet-scale security problem and one which we are working actively with our customers to solve. Auth0 was created to help make managing authentication simple for everyone, and, underpinning that is the desire to make it secure for everyone too.

<include src="asides/AboutAuth0" />


"credential-stuffing"