Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers account for 90% of login attempts at online retailers

qz.com

Post reply on HN
Print view View original

41–50 of 65 posts

Re: Hackers account for 90% of login attempts at online retailers

#41

Post by jsoverson »

jhinra wrote: post #39
ggggtez wrote: post #32

Earlier quoted context omitted.

Why would you think 90% is high? That's only 9 in 10. Remember, attackers using dictionary attacks are going to be trying hundreds or thousands of log in attempts, and a real user is only going to try at most a handful of times. You don't need that many attackers to easily approach 99% or higher. I'd say 90% is likely conservative for some companies.

I think 90% is high for a few reasons: 1) Rate limiting of login attempts takes a bite out of the large numbers you're talking about. If we are only looking at retail companies without rate limiting, well, duh, I guess >90% makes sense, but I expect a large portion of the global e-commerce retail segment _does_ employ rate limiting of logins. 2) The report lists, "Averages derived from customers’ login traffic before…

1) Proxies and botnets obscure origin and make attacks appear globally distributed so basic rate limiting has little effect on these attacks.

2) Extrapolated averages on incomplete data are certainly suspect, they are meant to be taken with a grain of salt and are most applicable to people in the affected industries for them to validate against their own data. FWIW The highest percentage of malicious, automated traffic that I've seen has been 99% which, yes, is crazy and should sound unbelievable.

3) Noted, definitely. It is certainly a tough number to nail down because it is very dependent on all the things you mention. I trust our data because we've been at this the longest, were the earliest, and we see a lot of the unadulterated attack traffic that has gotten through many existing defenses so we see the stark difference on day one.

Disclaimer: I contributed to the report in question (but was not consulted or related to the posted article)

Re: Hackers account for 90% of login attempts at online retailers

#42

Post by smeyer »

thaumaturgy wrote: post #24
swlkr wrote: post #13

Earlier quoted context omitted.

I also do this with websites I make. It is a little inconvenient, but it's worth it, assuming the person logging in as a secure way to access their email (2 factor auth).

It is a lot inconvenient, given the various and myriad issues with guaranteeing email deliverability. Multiple hosting providers use greylisting or something like it which can delay email by minutes to hours, depending on the behavior of the sending mail server. Almost all hosting providers use one or more layers of spam filtration which can incorrectly trap or dispose of your message. Many users have additional mail…

Can you expand on your preference for SMS password resets to email password resets? As a user I prefer email, but I'm biased by the fact that I used email for a decade before I had SMS and I've had a malicious actor gain control of my phone number and receive SMS on it but never had the same with email.

Re: Hackers account for 90% of login attempts at online retailers

#43

Post by greenshackle2 »

dahart wrote: post #28

Any time I start an ssh server for myself on a publicly accessible IP, hackers account for roughly 100% of login attempts. The legit logins are in the noise, and dictionary attacks on username and password fill the logs. With decent passwords, it's not much concern, but nowadays, I disable password logins completely.

I see a ton of attempts on my server that has SSH on a non-standard port. I imagine they don't all run port scans and I'd see even more on port 22.

Re: Hackers account for 90% of login attempts at online retailers

#44

Post by thaumaturgy »

smeyer wrote: post #42
thaumaturgy wrote: post #24

Earlier quoted context omitted.

It is a lot inconvenient, given the various and myriad issues with guaranteeing email deliverability. Multiple hosting providers use greylisting or something like it which can delay email by minutes to hours, depending on the behavior of the sending mail server. Almost all hosting providers use one or more layers of spam filtration which can incorrectly trap or dispose of your message. Many users have additional mail…

Can you expand on your preference for SMS password resets to email password resets? As a user I prefer email, but I'm biased by the fact that I used email for a decade before I had SMS and I've had a malicious actor gain control of my phone number and receive SMS on it but never had the same with email.

Sure, it's basically just down to those problems with email deliverability. As you correctly point out, SMS isn't a perfectly secure solution either; however, I almost always receive an SMS for authentication within a few seconds to a minute, and only in a few cases have never received the message at all.

If text messages were abused to the degree that email is, and all kinds of different things were developed to try to "solve" that abuse (as has happened with email), then deliverability would suffer and it would be a coin toss for which approach to use.

Re: Hackers account for 90% of login attempts at online retailers

#45

Post by davchana »

smeyer wrote: post #42
thaumaturgy wrote: post #24

Earlier quoted context omitted.

It is a lot inconvenient, given the various and myriad issues with guaranteeing email deliverability. Multiple hosting providers use greylisting or something like it which can delay email by minutes to hours, depending on the behavior of the sending mail server. Almost all hosting providers use one or more layers of spam filtration which can incorrectly trap or dispose of your message. Many users have additional mail…

Can you expand on your preference for SMS password resets to email password resets? As a user I prefer email, but I'm biased by the fact that I used email for a decade before I had SMS and I've had a malicious actor gain control of my phone number and receive SMS on it but never had the same with email.

Would you please elaborate how someone took over your phone & sms? This is my nightmare..

Re: Hackers account for 90% of login attempts at online retailers

#46

Post by graystevens »

daxorid wrote: post #21
jhinra wrote: post #19

I don't buy these numbers at all. 90% seems stupid high for retail. From the report, "[...] we rely on data from the Shape Network. Across the US, Shape’s customers represent: [..] 40% of Mobile Retail (by in-store payments)." "We estimated the number of credential stuffing attacks using the total number of credential stuffing attacks observed on Shape’s US customers and the total proportion of the US industry our cu…

Data point of one incoming. I work in ecommerce. 90% seems stupid low, based on our data. A couple years ago we were seeing a dozen or so successful login requests per minute against a background of ~40 unsuccessful requests per second . We were forced to implement rate-limiting on logins, which has resulted in more than a few customer service headaches. But it's now the reality of online retail.

I'll add another data point, from the consumer telecoms industry. 90% feels way too high from what we had to head with, even prior to implementing rate-limiting and other defences.

We ended up tracking actors as they switched up their techniques to evade us and our defences, and ended up learning a lot about credential stuffing, the tools involved and some of the motives behind them attacking lesser-known websites. We ended up blogging about our findings, should anyone else have to deal with this cat and mouse fun: https://breachinsider.com/blog/2017/credential-stuffing-how-...

Re: Hackers account for 90% of login attempts at online retailers

#47

Post by davchana »

QUFB wrote: post #9
mullen wrote: post #6

Earlier quoted context omitted.

The only way I see this problem going away is when regular retailers start supporting software and hardware two factor authenticators. I use Google Authenticator on any website that supports it and it does not impact the customer experience at all and it really improves security.

Agreed, but keep account recovery in mind. Account recovery is a major pain point for any site that supports TOTP 2FA. If you're not using a TOTP application that supports cloud backup (like Authy), when you lose or replace your mobile device the existing TOTP tokens are useless as they can't be recovered. This results in some type of account recovery process to reintroduce the 2FA tokens. Often these recovery proces…

I always save that TOTP Token or QR code in my seperate keepass database, so that if my Google Auth app breaks for any reason, I can install it fresh & re-scan those QRs from keepass.

Re: Hackers account for 90% of login attempts at online retailers

#48

Post by davchana »

jandrese wrote: post #22
drchickensalad wrote: post #11

Earlier quoted context omitted.

I'd like to get you started on SMS 2fa. I deal with this a lot at work and would like as much information as possible!

SMS is terribly insecure. Using it as a security system is a bad idea. SMS verification is more for discouraging bots from making accounts by making it expensive--you need to buy a cell phone. Every SMS verification system refuses to send to VoIP type accounts for this reason.

Exactly that's why I have disabled my Google email recovery via phone number. Only possibilities are Auth via an existing signed-in device, Google Auth, or backup codes.

Re: Hackers account for 90% of login attempts at online retailers

#49

Post by overcast »

cozzyd wrote: post #40
overcast wrote: post #14

Earlier quoted context omitted.

Passwords can already universally be recovered through email. I wish ALL sites had this feature. It's essentially a one time password, that expires.

Yeah, but be careful never to use an email that you might lose access to (which in principle, could be any email).

What's the difference? They'll just recover your passwords either way. Secure your email password, use two factor authentication. Now you're more secure than just about any website you're using.

Re: Hackers account for 90% of login attempts at online retailers

#50

Post by LeifCarrotson »

dahart wrote: post #28

Any time I start an ssh server for myself on a publicly accessible IP, hackers account for roughly 100% of login attempts. The legit logins are in the noise, and dictionary attacks on username and password fill the logs. With decent passwords, it's not much concern, but nowadays, I disable password logins completely.

My experience is the same. I set up a VPN for a coworker, who used it on 3 separate weeks away, connecting in total maybe 30 times. There were several MB of logs detailing illegitimate connection attempts.

It makes me curious what's really going over the wires and airwaves we love to hate for their low capacity and high cost. How much of that traffic is junk?

Post reply on HN