Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers account for 90% of login attempts at online retailers

qz.com

Post reply on HN
Print view View original

51–60 of 65 posts

Re: Hackers account for 90% of login attempts at online retailers

#51

Post by kevstev »

jhinra wrote: post #19

I don't buy these numbers at all. 90% seems stupid high for retail. From the report, "[...] we rely on data from the Shape Network. Across the US, Shape’s customers represent: [..] 40% of Mobile Retail (by in-store payments)." "We estimated the number of credential stuffing attacks using the total number of credential stuffing attacks observed on Shape’s US customers and the total proportion of the US industry our cu…

I worked at a very large e-commerce player, these numbers jive with my experience. Most people have their password saved in their browser, or get it right the first time. Maybe they screw up a few times, whatever. They may even have to reset, but they are in now, and you won't see a bad attempt from them for awhile.

Then you have Mr. Hacker, who is just going to spam the crap out of you until you actively stop him. If he is not so smart, he will go all in and try to brute force you from a single box as fast as he can. Smarter guys will rate limit themselves, even smarter guys will use botnets and VPNs. At this point time is on their side, they can just spray and pray, and even diversify their attempts by not just focusing on amazon.com, but hitting amazon, then target, then ebay, etc... you can now still be making whatever number of attempts per second, but fly under the radar (hopefully) of rate limiters and such.

Rate limiters and other counter measures help, but the point is that the bad guys are going to just keep trying and trying, while typical user flow is at most a few attempts. These attacks are almost always from overseas, particularly Russia, and so they have little fear of consequences.

Re: Hackers account for 90% of login attempts at online retailers

#52

Post by cozzyd »

overcast wrote: post #49
cozzyd wrote: post #40

Earlier quoted context omitted.

Yeah, but be careful never to use an email that you might lose access to (which in principle, could be any email).

What's the difference? They'll just recover your passwords either way. Secure your email password, use two factor authentication. Now you're more secure than just about any website you're using.

Well, for example if you're a student and you have you@your.edu, you might lose access to that account after you graduate.

Re: Hackers account for 90% of login attempts at online retailers

#53

Post by dogma1138 »

jhinra wrote: post #19

I don't buy these numbers at all. 90% seems stupid high for retail. From the report, "[...] we rely on data from the Shape Network. Across the US, Shape’s customers represent: [..] 40% of Mobile Retail (by in-store payments)." "We estimated the number of credential stuffing attacks using the total number of credential stuffing attacks observed on Shape’s US customers and the total proportion of the US industry our cu…

A large entailer in the UK that I’ve done PCI work for 3 years ago had simmilar figures in the mid 80%, that accounts for all attempts not successful ones.

Another anecdote is that even non-compromised accounts that were not regularly used had on average 4 failed attempts before a successful login with password recovery used in more than 50% of these cases, to the point where the majority of all login attempts were failed attempts.

The “compromised” accounts were identified by using information form fraud detection services and accounts that did not complete a password recovery after multiple failed attempts as well as a few other indicators.

While I understand your skepticism you need to understand just how common this issue is.

When hackers/fraudsters get any set of credentials from a leak or phishing they try it on 100’s if not 1000’s of sites multiply it by the number of fraudsters and hacking groups that sell login details in bulk and it’s essentially the spam of the internet world.

Re: Hackers account for 90% of login attempts at online retailers

#54

Post by busterarm »

vxNsr wrote: post #38
busterarm wrote: post #35

Earlier quoted context omitted.

How does that deal with email providers that follow all links with their virus scanner? (many corp emails...) Usually these credentials are one-time usage.

I'd guess however any service that requires account confirmation to work. This sounds like a solved problem, though I don't really know.

Not everyone as solved it. It is an actual issue that people have.

Re: Hackers account for 90% of login attempts at online retailers

#55

Post by dogma1138 »

choward wrote: post #15
overcast wrote: post #14

Earlier quoted context omitted.

Passwords can already universally be recovered through email. I wish ALL sites had this feature. It's essentially a one time password, that expires.

Exactly. The only password that really matters is the one for your email. Everything else just provides additional attack vectors.

That only works for services that do not store any sensitive data and employ costumer controller encryption, if your password is used as a cryptographic tool then it’s out of the question to use such mechanism.

Re: Hackers account for 90% of login attempts at online retailers

#56

Post by dogma1138 »

cozzyd wrote: post #52
overcast wrote: post #49

Earlier quoted context omitted.

What's the difference? They'll just recover your passwords either way. Secure your email password, use two factor authentication. Now you're more secure than just about any website you're using.

Well, for example if you're a student and you have you@your.edu, you might lose access to that account after you graduate.

And providers like GMail can ban your account without warning or recovery options.

Re: Hackers account for 90% of login attempts at online retailers

#57

Post by thunfischbrot »

jsoverson wrote: post #41
jhinra wrote: post #39

Earlier quoted context omitted.

I think 90% is high for a few reasons: 1) Rate limiting of login attempts takes a bite out of the large numbers you're talking about. If we are only looking at retail companies without rate limiting, well, duh, I guess >90% makes sense, but I expect a large portion of the global e-commerce retail segment _does_ employ rate limiting of logins. 2) The report lists, "Averages derived from customers’ login traffic before…

1) Proxies and botnets obscure origin and make attacks appear globally distributed so basic rate limiting has little effect on these attacks. 2) Extrapolated averages on incomplete data are certainly suspect, they are meant to be taken with a grain of salt and are most applicable to people in the affected industries for them to validate against their own data. FWIW The highest percentage of malicious, automated traff…

Most legitimate users will also not have to log in each time they visit, making the ratio even less surprising.

Re: Hackers account for 90% of login attempts at online retailers

#58

Post by overcast »

cozzyd wrote: post #52
overcast wrote: post #49

Earlier quoted context omitted.

What's the difference? They'll just recover your passwords either way. Secure your email password, use two factor authentication. Now you're more secure than just about any website you're using.

Well, for example if you're a student and you have you@your.edu, you might lose access to that account after you graduate.

Same issue applies if you forget your password to any site.

Re: Hackers account for 90% of login attempts at online retailers

#59

Post by vxNsr »

busterarm wrote: post #54
vxNsr wrote: post #38

Earlier quoted context omitted.

I'd guess however any service that requires account confirmation to work. This sounds like a solved problem, though I don't really know.

Not everyone as solved it. It is an actual issue that people have.

No I mean that seeing how widespread click-to-confirm emails are I'd think there are best practices for how to implement them to avoid fake clicks. Whether those ideas are followed by everyone is another story, but all the pitfalls that people are pointing out apply in one way or another to the password system as well.

Re: Hackers account for 90% of login attempts at online retailers

#60

Post by vxNsr »

dogma1138 wrote: post #55
choward wrote: post #15

Earlier quoted context omitted.

Exactly. The only password that really matters is the one for your email. Everything else just provides additional attack vectors.

That only works for services that do not store any sensitive data and employ costumer controller encryption, if your password is used as a cryptographic tool then it’s out of the question to use such mechanism.

Whatsapp has figured out a solution to this problem. i.e. what is your Whatsapp password?
Post reply on HN