{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/credential-stuffing","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/credential-stuffing/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/credential-stuffing/"},"term":{"en":"Credential stuffing","da":"Credential stuffing"},"aka":{"en":[],"da":[]},"domain":["security"],"cluster":"fundamentals","layer":"identity","status":"current","era":2014,"summary":{"en":"Trying stolen user names and passwords from one leak on many other sites, hoping people used the same password there.","da":"At prøve stjålne brugernavne og adgangskoder fra ét læk på mange andre sider i håb om, at folk har genbrugt adgangskoden."},"body":{"formal":{"en":"An automated attack in which large lists of login details, taken from an earlier data breach elsewhere, are fed into the login pages of other services. It does not guess; it relies on people reusing the same password across accounts.","da":"Et automatiseret angreb, hvor store lister med loginoplysninger fra et tidligere databrud et andet sted fodres ind i login-siderne på andre tjenester. Der gættes ikke; angrebet bygger på, at folk genbruger den samme adgangskode på flere konti."},"plain":{"en":"A thief finds your house key on the street and then tries it on your car, your office and your summer house - just in case.","da":"En tyv finder din hoveddørsnøgle på gaden og prøver den så i din bil, på dit kontor og i dit sommerhus - for en sikkerheds skyld."},"inPractice":{"en":"After a fitness app leaks its users' logins, attackers run the list against a Danish online shop; a few thousand customers find orders paid with their saved cards before the shop's IT lead blocks the flood of login attempts.","da":"Efter at en fitness-app har lækket brugernes logins, kører angribere listen mod en dansk webshop; et par tusinde kunder finder ordrer betalt med deres gemte kort, før webshoppens IT-ansvarlige får stoppet strømmen af loginforsøg."},"whyItMatters":{"en":"One leak at a small, careless site can unlock accounts at a bank or an employer, which is why a different password for each site and MFA matter so much.","da":"Ét læk hos en lille, sjusket side kan åbne konti i en bank eller hos en arbejdsgiver, og derfor betyder unikke adgangskoder og MFA så meget."}},"deepDive":{"en":"Credential stuffing is catalogued as MITRE ATT&CK T1110.004 and as OWASP Automated Threat OAT-008, distinct from credential cracking (OAT-007). The input is a combolist: millions of email/password or username/password pairs harvested from earlier breaches, infostealer logs and phishing kits, deduplicated and traded or leaked. Tooling such as configurable \"checker\" frameworks replays each pair against a target's login endpoint or its underlying API, parses the response to tell success from failure, and saves working accounts (\"hits\") for resale or takeover. Per-attempt success rates are low, but at millions of attempts even a small fraction yields thousands of accounts.\n\nThe engineering effort goes into evasion. Requests are spread across large pools of residential and mobile proxies so that no single IP address stands out, user agents and TLS fingerprints are rotated or copied from real browsers, headless browsers execute JavaScript challenges, and CAPTCHAs are passed to human or automated solving services. Attackers often prefer mobile or legacy API endpoints, which tend to have weaker bot controls than the web login form. This is why per-IP rate limiting alone rarely stops a competent campaign.\n\nIt differs from its neighbours in how the guess is chosen. Classic brute force (T1110.001, password guessing) tries many passwords against one account; password spraying (T1110.003) tries a few common passwords against many accounts to stay under lockout thresholds; credential stuffing tries one known password per account, so account lockout barely triggers. Session hijacking skips authentication entirely by stealing an already issued session token, which is also how infostealer-driven attacks sidestep a password change.\n\nDefences work in layers. NIST SP 800-63B-4 §3.1.1.2 requires verifiers to compare new passwords against a blocklist that may include breach corpuses; services such as Have I Been Pwned's Pwned Passwords expose this through a k-anonymity range API, where only the first five hex characters of the SHA-1 hash leave the client. At login, detection relies on signals such as a spike in failed logins across many distinct accounts, high rates of unknown usernames, device fingerprinting and impossible-travel checks, with step-up challenges instead of hard blocks. MFA removes most of the value of a reused password, and phishing-resistant authenticators such as passkeys (FIDO2/WebAuthn) remove the shared secret altogether. A successful stuffing attack against personal data can still be a personal data breach under GDPR Art. 33 even though the service itself was never \"hacked\".","da":"Credential stuffing er registreret som MITRE ATT&CK T1110.004 og som OWASP Automated Threat OAT-008 og adskiller sig fra credential cracking (OAT-007). Råmaterialet er en combolist: millioner af par af e-mail/adgangskode eller brugernavn/adgangskode høstet fra tidligere databrud, infostealer-logs og phishingkits, renset for dubletter og handlet eller lækket. Værktøjer i form af konfigurerbare \"checkere\" afspiller hvert par mod målets login-endpoint eller det bagvedliggende API, fortolker svaret for at skelne succes fra fejl og gemmer de brugbare konti (\"hits\") til videresalg eller overtagelse. Succesraten pr. forsøg er lav, men ved millioner af forsøg giver selv en lille brøkdel tusindvis af konti.\n\nDet tekniske arbejde ligger i at undgå at blive opdaget. Forespørgslerne spredes over store puljer af residential- og mobilproxyer, så ingen enkelt IP-adresse skiller sig ud; user agents og TLS-fingeraftryk roteres eller kopieres fra rigtige browsere; headless browsere kører JavaScript-udfordringer; og CAPTCHA'er sendes videre til menneskelige eller automatiserede løsningstjenester. Angriberne foretrækker ofte mobil- eller legacy-API'er, som typisk har svagere botbeskyttelse end webformularen. Derfor stopper rate limiting pr. IP-adresse sjældent en kompetent kampagne alene.\n\nForskellen til naboangrebene ligger i, hvordan gættet vælges. Klassisk brute force (T1110.001, password guessing) prøver mange adgangskoder mod én konto; password spraying (T1110.003) prøver få almindelige adgangskoder mod mange konti for at holde sig under lockout-grænsen; credential stuffing prøver én kendt adgangskode pr. konto, så kontospærring næsten ikke udløses. Sessionskapring springer autentificeringen helt over ved at stjæle et allerede udstedt sessionstoken, og det er også sådan, infostealer-baserede angreb omgår et skift af adgangskode.\n\nForsvaret er lagdelt. NIST SP 800-63B-4 §3.1.1.2 kræver, at nye adgangskoder sammenlignes med en blokliste, som kan indeholde lækkede adgangskoder; tjenester som Have I Been Pwned's Pwned Passwords udstiller det via et k-anonymitets-API, hvor kun de første fem hex-tegn af SHA-1-hashen forlader klienten. Ved login bygger detektion på signaler som en stigning i fejlede logins på tværs af mange forskellige konti, mange ukendte brugernavne, device fingerprinting og impossible travel, med step-up-udfordringer frem for hårde blokeringer. MFA fjerner det meste af værdien ved en genbrugt adgangskode, og phishing-resistente løsninger som passkeys (FIDO2/WebAuthn) fjerner den delte hemmelighed helt. Et vellykket angreb mod konti med personoplysninger kan stadig være et brud på persondatasikkerheden efter GDPR art. 33, selv om tjenesten aldrig selv blev \"hacket\"."},"edges":[{"type":"requires","to":"cs/credential","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/threat","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/session-hijacking","why":{"en":"Credential stuffing comes in through the front door with a reused password; session hijacking skips the login and takes over someone already logged in.","da":"Credential stuffing kommer ind ad hoveddøren med en genbrugt adgangskode; sessionskapring springer login over og overtager en, der allerede er logget ind."},"confidence":"medium","strength":"normal"},{"type":"exploits","to":"cs/password","why":{"en":"It works only because people use the same password on more than one account.","da":"Det virker kun, fordi folk bruger den samme adgangskode på mere end én konto."},"confidence":"high","strength":"primary"}],"depth":2,"sources":[{"title":"OWASP - Credential Stuffing","url":"https://owasp.org/www-community/attacks/Credential_stuffing","tier":"reference","publisher":"OWASP"},{"title":"MITRE ATT&CK - T1110.004 Brute Force, Credential Stuffing","url":"https://attack.mitre.org/techniques/T1110/004/","tier":"reference","publisher":"MITRE"},{"title":"NIST SP 800-63B-4 - Digital Identity Guidelines, Authentication and Authenticator Management","url":"https://pages.nist.gov/800-63-4/sp800-63b.html","tier":"standard","publisher":"NIST"}],"draft":true}