Becoming You: A Glimpse Into Credential Abuse
summary
Credential abuse is automated credential stuffing and account takeover: attackers use phishing, leaks and buy lists, then verify logins with botnets — a 24‑hour snapshot shows 420 distinct botnets targeting 45 sites and checking 34 million accounts, with 66% of logins flagged malicious. Defenses move from IP rate limits to sliding window and session tracking, CDN-enforced rate controls, JS behavioral challenges (mouse/keystroke cadence), honeypots, TCP throttling and evolving AI/ML classifiers.
AI-written summary · about
chapters (8)
- 0:00Introduction to the topic
- 1:25Defining credential abuse
- 3:55Attack methods and impact
- 7:28Business risk and botnets
- 11:31Detection and mitigation
- 17:34Advanced defense techniques
- 20:59Best practices and future
- 24:20Q&A and session wrap-up
related talks
41mThe State Of Credential Stuffing And The Future Of Account Takeovers
44mThe Unpatchables: Credential Stuffing Quantification and Classification
51mAutomated Threats: The Rise of Bots and What to Do About It
26mIntegrating Identity and Fraud
41m📙 The Great Credential Caper: How to Perform and then Defend Against the (Nearly Impossible) to Defend 🏗️
40mWeb Attacks and Fraud: Lessons Learned from the Deep End of the Pool
40mYou have a security problem - your users
31mLog In Through the Front Door: Automating Defense Against...