The State Of Credential Stuffing And The Future Of Account Takeovers
summary
Credential stuffing relies on concrete numbers and tools: attackers start with 2.3 billion unique credentials from public dumps, use Sentry MBA or Browser Automation Studio plus Selenium/Puppeteer, bypass reCAPTCHA via DeathByCaptcha or human farms, rotate proxies including Hola and cloud functions, and buy distributed traffic and CAPTCHA solves so each attempt costs under $0.002 per try. Malware/extension markets like Genesis sell harvested cookies and real device fingerprints, so defenses must track actual attack techniques, success rates (0.2–2%) and transaction value.
AI-written summary · about
chapters (34)
- 0:00Introduction
- 5:52How Much Does It Cost
- 11:56Distribute Globally
- 12:50Cost
- 13:43Rate Of Return
- 15:27How To Start
- 15:44What Are Combo Lists
- 16:39IP Rate Limiting
- 19:12CAPTCHAs
- 19:44Dynamic Sites
- 20:33Host Header Order
- 21:28Consumer Browsers
- 21:56Browser fingerprinting
- 22:30Fraudfox
- 23:24Identifying Bots
- 24:07NonHuman Behavior
- 24:57Browser Consistency Check
- 25:53Browser Fingerprints
- 26:28Emulation
- 27:30Multifactor authentication does not stop credential stuffing
- 28:51How to bypass multifactor authentication
- 31:10Logging into your bank
- 31:31Resident script
- 32:39Browser extensions
- 33:01Exploit a developer machine
- 33:39What is beyond credential stuffing
- 34:01Genesis
- 35:03One Unit
- 35:37Known Resources
- 35:56Fingerprints
- 36:29Risk Scores
- 36:59Dont Screw Your Buddies
- 37:23Advanced Malware
- 38:48Fraud Problems
related talks
29mBecoming You: A Glimpse Into Credential Abuse
44mThe Unpatchables: Credential Stuffing Quantification and Classification
40mYou have a security problem - your users
41m📙 The Great Credential Caper: How to Perform and then Defend Against the (Nearly Impossible) to Defend 🏗️
26mIntegrating Identity and Fraud
40mWeb Attacks and Fraud: Lessons Learned from the Deep End of the Pool
51mAutomated Threats: The Rise of Bots and What to Do About It
32mFriend or Replicant: How Attackers Automate and Disguise Themselves