Credential Stuffing Defenses

Credential Stuffing: Why Password Reuse Makes Scale the Attacker's Friend

Credential stuffing is an attack where an attacker uses automated tools to replay username and password pairs leaked from one service against many other services. The attack exploits a simple reality: users reuse passwords across multiple sites. When one service is breached, the leaked credentials work everywhere the user has reused their password.

The Economics of Credential Stuffing

The attacker's cost:

• Leaked credential lists are freely available on the dark web (collections like Compilation of Many Breaches contain billions of pairs)
• Automated tools (OpenBullet, Sentry MBA, STORM) cost nothing or very little
• Botnets of thousands of IP addresses are available for rent
• The cost per login attempt is fractions of a cent

The attacker's success rate:

• Industry estimates suggest 0.1-2% of attempts succeed
• With 10 million credential pairs, even 0.1% success = 10,000 compromised accounts
• Each compromised account can be monetized (fraud, resale, data theft)

The defender's challenge:

• Legitimate users and attackers look identical at the login endpoint
• Each IP makes only a few requests (distributed across thousands of IPs)
• Rate limiting per IP is ineffective

How Credential Stuffing Attacks Work

Attack infrastructure:

1. Credential lists: Username/email and password pairs from data breaches
2. Proxy rotation: Thousands of residential IP addresses to avoid rate limits
3. Browser automation: Headless browsers (Puppeteer, Selenium) that execute JavaScript and mimic human behavior
4. CAPTCHA solving: Services that solve CAPTCHAs for a fee (or ML-based solvers)

Attack flow:

1. Attacker loads a list of credential pairs
2. For each pair, the tool sends a login request from a different IP address
3. The tool mimics human behavior (random delays, mouse movements, realistic headers)
4. Successful logins are collected and monetized

Defending Against Credential Stuffing with Multiple Layers

No single defense stops credential stuffing. A comprehensive strategy combines multiple layers, each addressing a different aspect of the attack.

Layer 1: Breach Password Detection

Prevent users from setting passwords that have been exposed in known data breaches:

import hashlib
import requests

def is_pwned_password(password):
    sha1 = hashlib.sha1(password.encode('utf-8')).hexdigest().upper()
    prefix, suffix = sha1[:5], sha1[5:]
    
    response = requests.get(
        f'https://api.pwnedpasswords.com/range/{prefix}',
        headers={'Add-Padding': 'true'}
    )
    
    for line in response.text.splitlines():
        hash_suffix, count = line.split(':')
        if hash_suffix == suffix:
            return True, int(count)
    
    return False, 0

Key features:

• k-anonymity: Only the first 5 characters of the SHA-1 hash are sent to the API
• Privacy: The full password is never transmitted
• User experience: Inform users why their password was rejected without revealing the specific breach

Layer 2: Multi-Factor Authentication (MFA)

MFA is the single most effective defense against credential stuffing. Even if the attacker has the correct username and password, they cannot complete login without the second factor.

Layer 3: Bot Detection and Device Fingerprinting

• Require JavaScript execution before accepting login requests
• Analyze behavioral signals (mouse movements, keystroke dynamics, timing)
• Use device fingerprinting to identify suspicious patterns
• Assign risk scores and apply step-up authentication for high-risk attempts

Layer 4: Rate Limiting and Monitoring

• Implement per-account rate limiting (across all IPs, not per-IP)
• Monitor for credential stuffing patterns (many accounts, few attempts each)
• Alert on anomalous login patterns (unusual geographic distribution, timing)
• Implement CAPTCHA after a threshold of failed attempts