Okta Warns of Spike Facilitated by Proxy Networks

Credential stuffing attacks, a growing threat to online security, have seen a recent surge according to identity and access management (IAM) provider Okta. These attacks exploit previously stolen usernames and passwords, attempting to gain unauthorized access to accounts across various online services.

How Credential Stuffing Works

Credential stuffing relies on a readily available pool of compromised login credentials. These credentials can be obtained from various sources, including:

• Data breaches: When a company experiences a data breach, attackers can gain access to vast troves of usernames and passwords.
• Phishing attacks: Phishing emails or websites trick users into revealing their login information on fraudulent login pages.
• Malware: Malicious software can be installed on a user’s device to steal login credentials.

Once attackers have a collection of stolen credentials (often referred to as “combo lists”), they automate the login process using scripts. These scripts attempt to use the stolen credentials to log in to various online services. If the username and password combination works on a particular service, the attacker gains unauthorized access to the account.

Proxy Networks: Masking the Attacker’s Identity

Okta’s warning highlights a concerning trend: attackers are increasingly utilizing proxy networks to launch credential stuffing attacks. Proxy networks act as intermediaries between a user’s device and the internet. Traffic routed through a proxy server appears to originate from the proxy’s location, masking the attacker’s true IP address.

There are two main types of proxies used in credential stuffing attacks:

• Tor: The Onion Router (Tor) network is a free, anonymizing service that routes traffic through multiple relays, making it nearly impossible to trace the source.
• Residential proxies: These services provide IP addresses that appear to originate from individual residences. This makes it more difficult for security measures to detect automated login attempts, as they can mimic legitimate user traffic.

The Rise in Mobile Proxy Attacks

Okta’s research also identified a novel attack vector: mobile devices unknowingly participating in proxy networks. This can happen when users download apps containing compromised Software Development Kits (SDKs). These malicious SDKs can enroll the user’s device in a residential proxy network without their knowledge. As a result, the attacker’s traffic appears to originate from the user’s mobile device, further obfuscating the attack.

Protecting Yourself from Credential Stuffing Attacks

While credential stuffing attacks pose a significant threat, there are steps you can take to protect yourself:

• Use strong, unique passwords for every online service. Password managers can be helpful in creating and storing complex passwords.
• Enable multi-factor authentication (MFA) whenever possible. MFA adds an extra layer of security by requiring a second verification step, such as a code from your phone, to log in.
• Be cautious of phishing emails and websites. Don’t click on suspicious links or attachments, and be wary of unsolicited requests for your login information.
• Stay informed about data breaches. If you learn that a service you use has been breached, change your password immediately.

By following these security best practices, you can significantly reduce the risk of falling victim to credential stuffing attacks.

You think you have a story worth everyone’s time? SUBMIT A STORY and we will publish it.