Okta alerts customers against new credential-stuffing attacks (2024)

FAQs

Okta alerts customers against new credential-stuffing attacks? ›

Okta is advising customers to go passwordless to protect against credential-stuffing attacks. “Enroll users in passwordless, phishing-resistant authentication,” the company said. “We recommend the use of passkeys as the most secure option. Passkeys are included on all Auth0 plans from our free plan through Enterprise.”

Rate Limiting & Throttling

They use automated solutions that allow them to target one or multiple accounts with a large number of requests in a very short amount of time. So an effective method against credential stuffing is to set up server-side scripts or security solutions that monitor and restrict the request rate.

Anonymizing services and residential proxies have been blamed for an “unprecedented” surge in credential stuffing attacks against Okta customers over the past week. The identity and access management vendor said its Identity Threat Research team observed a spike in attacks against user accounts between April 19 and 26.

What is credential stuffing? Credential stuffing is a cyber attack in which credentials obtained from a data breach on one service are used to attempt to log in to another unrelated service.

The source of the problem? Credential stuffing. Just hours after the launch, Disney+ account credentials were put up for sale on dark web forums. By testing massive volumes of previously stolen usernames and passwords on the Disney+ streaming site, hackers could easily identify valid credential pairs.

Use multi-factor authentication (MFA)

Multi-factor authentication (MFA) helps prevent credential stuffing attacks by adding an extra layer of security by requiring multiple forms of verification, typically: Something You Know: Usually a username and password combination.

CAPTCHA. Requiring a user to solve a "Completely Automated Public Turing test to tell Computers and Humans Apart" (CAPTCHA) or similar puzzle for each login attempt can help to identify automated/bot attacks and help prevent automated login attempts, and may slow down credential stuffing or password spraying attacks.

Mounting woes. In 2022, Okta got hit by a phishing attack, a breach and had its GitHub source code stolen. Last year, a string of attacks hit high-profile customer environments over the summer and a third-party vendor attack exposed health information on nearly 5,000 current and former Okta employees.

Phishing: Attackers can use social engineering techniques to trick users into providing their MFA credentials. This can include fake login pages or phishing emails that ask users to enter their MFA codes or accept the push notification from the authenticator app.

Credential Stuffing is a subset of the brute force attack category. Brute forcing will attempt to try multiple passwords against one or multiple accounts; guessing a password, in other words. Credential Stuffing typically refers to specifically using known (breached) username / password pairs against other websites.

What is the credential stuffing defense? ›

Requiring users to authenticate with something they have, in addition to something they know, is the best defense against credential stuffing. Attacker bots will not be able to provide a physical authentication method, such as a mobile phone or access token.

Credential stuffing is a type of cyberattack in which the attacker collects stolen account credentials, typically consisting of lists of usernames or email addresses and the corresponding passwords (often from a data breach), and then uses the credentials to gain unauthorized access to user accounts on other systems ...

Credential stuffing attacks can be very costly; in fact, the Ponemon Institute puts the cost to businesses at an average of $6 million per year, and this figure doesn't include the reputational damage to organizations and the financial losses victims suffer.

Examples of credential stuffing attacks

Despite being a big name in the cyber security space, at the start of 2023, Norton was hit but a brute force credential stuffing attack that saw threat actors using stolen credentials to log into customer accounts and access their data. Over 925,000 people were targeted.

To prevent credential stuffing, enable multi-factor authentication (MFA), require complex passwords, and educate employees about the danger of using weak passwords or using the same password on multiple systems.

Credential stuffing is a tactic where hackers utilise stolen login credentials from one organisation's platform, to gain unauthorised access to multiple user accounts across other organisations.

In summary, multi-factor authentication, URL Filtering Profiles, and WildFire Profiles are three key features that help prevent abuse of stolen credentials by adding extra layers of security, blocking access to malicious websites, and identifying and blocking new and unknown malware.

According to OWASP, the most effective way to prevent broken authentication is to “implement multi-factor authentication to prevent automated, credential stuffing, brute force, and stolen credential reuse attacks.” Multi-factor authentication adds an extra layer of security that is difficult for hackers to crack which ...