Technique
technique:credential_reuse
Also: credential stuffing, password reuse
Using the same password across personal, social, and workplace accounts, enabling compromise of multiple services.
Use of a password found in a document to access the principal’s Twitter account and then the school website.
“I see at the bottom of the text document he has a Twitter password”
“what if he’s using the password for his Twitter for this?”
Using one recovered password to gain access to additional Citibank nodes.
“once the hacker got one known password they were able to get more passwords.”
“They scanned all 363 Citibank nodes to see which ones they could log in with with these new passwords.”
Using the same password across personal, social, and workplace accounts, enabling compromise of multiple services.
“His Twitter, Facebook, LinkedIn, and Google accounts all had the same password”
“Don’t reuse passwords like that.”
Trying collected email addresses and passwords against victims’ Facebook, LinkedIn, and email accounts.
“try to log in with this e-mail and password”
“they would sometimes be able to log into Facebook or LinkedIn or even their e-mail inboxes”
Reusing the same password across connected websites, enabling access from Records Check to National Public Data.
“Sal reused passwords, which allowed Luan to log in to National Public Data”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Finn | Explicit | 17 |
| incoming | INITIAL_ACCESS_VIA | Dropbox breach | Uncertain | 86 |
| incoming | INVOLVES | Dropbox breach | Explicit | 86 |
| incoming | USES | Axact | Explicit | 142 |
| incoming | USES | USDoD | Explicit | 177 |
Finn USES credential reuse
Finn tried passwords found in the principal’s password document against the principal’s Twitter account and later reused the Twitter password on the school website.
Explicit Confidence 99% · Finn EP 17 Details
“I go through the list of passwords. I tried the first one on his Twitter”
“what if he’s using the password for his Twitter for this?”
Dropbox breach INITIAL_ACCESS_VIA credential reuse
The hacker appears to have entered Dropbox using a reused password belonging to a Dropbox engineer; Jack is uncertain whether the same password was used at Dropbox.
Uncertain Confidence 89% · Jack Rhysider EP 86 Details
“But did this engineer use the same password where he worked too, at Dropbox? I don’t know for sure but the hacker was able to login as the engineer at Dropbox.”
Dropbox breach INVOLVES credential reuse
The Dropbox engineer acknowledged reusing the same password across several personal accounts, enabling the hacker to access additional accounts.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“His Twitter, Facebook, LinkedIn, and Google accounts all had the same password”
Axact USES credential reuse
Axact employees tried users’ clear-text passwords on Facebook, LinkedIn, and email accounts to exploit password reuse.
Explicit Confidence 99% · Jack Rhysider EP 142 Details
“Axact employees could see the users’ passwords and try using those passwords on their social media accounts”
USDoD USES credential reuse
USDoD exploited Sal's reused passwords to move from Records Check into National Public Data.
Explicit Confidence 99% · Jack Rhysider EP 177 Details
“Sal reused passwords, which allowed Luan to log in to National Public Data”