Technique
technique:credential_stuffing
Also: combo list attacks, commons, cracking accounts
Reuse of exposed credentials against other accounts or services.
Reuse of exposed credentials against other accounts or services.
“Most were very grateful because credential stuffing was not such a big topic in 2016”
Automated testing of reused username-and-password combinations against many services.
“have a tool just automatically try logging into tons of sites”
Derived classification for trying recovered credentials against multiple accounts and services.
“we tried a bunch of different accounts after Skype”
“we tried it on a MediaFire page, which worked”
Trying lists of usernames and passwords against online services to obtain accounts with valuable balances or points.
“you’d build up these points and you could spend the points on free rooms”
“load up a massive list of usernames and passwords and try them against the Hilton log-in page”
Trying usernames and passwords obtained from data breaches against streaming services.
“90% of internet log-ins are just people trying different data-breached passwords and usernames”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | The Guild of the Grumpy Old Hackers | Explicit | 87 |
| incoming | USES | Combo list | Explicit | 112 |
| incoming | USES | SIM swapping | Explicit | 112 |
| incoming | USES | Professor Dubstep | Derived | 148 |
| incoming | USES | Conor Freeman | Explicit | 154 |
The Guild of the Grumpy Old Hackers USES Credential stuffing
The Guild warned people that passwords exposed in the LinkedIn dump could be reused to access other accounts.
Explicit Confidence 98% · Victor EP 87 Details
“Most were very grateful because credential stuffing was not such a big topic in 2016 but it was going on.”
Combo list USES Credential stuffing
Combo lists are used to test reused username-and-password combinations against many sites.
Explicit Confidence 99% · Jack Rhysider EP 112 Details
“you could take this combo list and have a tool just automatically try logging into tons of sites”
SIM swapping USES Credential stuffing
Drew describes SIM-swappers using reused credentials from databases to identify and access Coinbase accounts.
Explicit Confidence 97% · Drew EP 112 Details
“They’re using commons from databases, getting into Coinbase – this is all automated – and then they get their balance; they had SIM-swapped them”
Professor Dubstep USES Credential stuffing
Professor Dubstep describes taking credentials from breached databases and trying them against many services used by musicians.
Derived Confidence 95% · Jack Rhysider EP 148 Details
“We’ve got Skrillex’s password. It works on an old Skype account”
Conor Freeman USES Credential stuffing
Conor describes trying lists of usernames and passwords against Hilton accounts to obtain accounts with reward points.
Explicit Confidence 99% · Conor Freeman EP 154 Details
“They’d load up a massive list of usernames and passwords and try them against the Hilton log-in page”