What is credential stuffing and how can I protect myself? A cybersecurity researcher explains
Cyber-skulduggery is becoming the bane of modern life. Australia's prime minister has called it a “scourge”, and he is correct. In 2022–23, nearly 94,000 cyber crimes were reported in Australia, up 23% on the previous year.
In the latest high-profile attack, around 15,000 customers of alcohol retailer Dan Murphy, Mexican restaurant chain Guzman y Gomez, Event Cinemas, and home shopping network TVSN had their login credentials and credit card details used fraudulently to buy goods and services in what is known as a “credential stuffing” attack.
So what is credential stuffing – and how can you reduce the risk of it happening to you?
Credential stuffing is a type of cyber attack where hackers use stolen usernames and passwords to gain unauthorised access to other online accounts.
We are now on WhatsApp. Click to join.
In other words, they steal a set of login details for one site, and try it on another site to see if it works there too.
This is possible because many people use the same username and password combination across multiple websites.
It is common for people to use the same password for multiple accounts (even though this is very risky).
Some even use the same password for all their accounts. This means if one account is compromised, hackers can potentially access many (or all) their other accounts with the same credentials.
Hackers purchase job lots of login credentials (obtained from earlier data breaches) on the “dark web”.
They then use automated tools called “bots” to perform credential stuffing attacks. These tools can also be purchased on the dark web.
Bots are programmes that perform tasks on the internet much faster and more efficiently than humans can.
In what is colourfully termed a “brute force” attack, hackers use bots to test millions of username and password combinations on different websites until they find a match. It's easier and quicker than many people realise.
It is happening more often because the barrier to entry for would-be cybercriminals has
Read more on tech.hindustantimes.com
