Credential Stuffing vs. Password Spraying

Passwords are the Achilles heel of cybersecurity.

Threat actors don’t need a fancy 0-day when they can simply log in instead.

Two common methods that attackers use to compromise user’s accounts are credential stuffing and password spraying.

While the terms are often used interchangeably, there are differences.

In this post, you’ll learn how these two attacks differ as well as how organizations can defend against them.

Table of contents:

What is credential stuffing?

Credential stuffing is a type of password attack in which bad actors use automated tools to try large numbers of stolen username and password combinations to gain unauthorized access to user accounts. This type of attack is very effective because many people reuse the same passwords across multiple accounts.

In a credential stuffing attack, the attacker typically takes a list of usernames and passwords from a previous data breach or from the dark web. They then use automated software to test these credentials against multiple websites or applications. When a match is found, the attacker can gain access to the account and potentially exploit it for malicious purposes, such as stealing personal information, committing fraud, or launching further attacks.

A hypothetical example of credential stuffing might involve an attacker who found a victim’s Amazon credentials in an infostealer log. They then test the same credentials on GMail, Facebook, LinkedIn, Netflix, etc, to see where else they are valid. The attack may not stop there. If, for example, the breached password was Password1!, they may try other variations, such as:

• Password2!
• 1Password!
• NewPassword1!
• Password1@

Normally, this is done until the account gets locked out, in which case, the attacker simply moves on to the next website.

What is password spraying?

Password spraying is a type of password attack where attackers don’t know their target’s password. Instead, they try a few commonly used passwords against many usernames or email addresses. Unlike traditional brute-force attacks, where an attacker tries many passwords against a single account, password spraying is more stealthy by only trying a few common passwords. Thus, it’s less likely to trigger automated account lockouts or detection systems.

The goal of password spraying is to find accounts that have weak or commonly used passwords. Attackers often use this technique because it can be more effective than brute-force attacks, especially against organizations that have lax password policies or where users tend to choose weak passwords. Once attackers have identified accounts with weak passwords, they can use those accounts to gain access to systems, steal data, or carry out other malicious activities.

A password spraying attack might look like this:

• Username: Sally Password: 12345678
• Username: Bob Password: 12345678
• Username: Jill Password: 12345678
• Username: Peter Password: 12345678

What’s the difference between credential stuffing and password spraying?

While credential stuffing and password spraying are both forms of brute force attacks, they differ in the following way:

• Credential Stuffing: The attackers use a list of valid credentials from one site and try to authenticate with the same credentials on other sites. This attack exploits password reuse.
• Password Spraying: The attackers rotate through many usernames, trying a single (or small number of) common passwords. This attack avoids account lockout and exploits weak passwords.

Other types of password attacks

Besides credential stuffing and password spraying, there are several other types of password attacks that are used to gain unauthorized access to accounts. Some common types include:

Brute-force attacks

In a brute-force attack, an attacker tries every possible combination of characters until the correct password is found. This method is computationally intensive and time-consuming, but it can be effective against weak passwords, especially if they are short or use common patterns.

Dictionary attacks

Similar to brute-force attacks, dictionary attacks use a predefined list of common passwords or words to try to guess the password. This method is more efficient than brute force because it doesn’t need to try every possible combination, but it relies on users choosing passwords that are in the attacker’s dictionary.

Phishing

Phishing attacks attempt to trick users into revealing their passwords by posing as legitimate entities, such as IT support or their bank. Attackers often use fake websites or emails that look convincing to trick users into entering their login credentials.

Keylogging

Keylogging malware like infostealers, records keystrokes on a user’s computer, allowing attackers to capture passwords as they are typed. This method can be used to steal passwords for various accounts without the user’s knowledge.

Man-in-the-middle (MITM) attacks

In a MITM attack, an attacker intercepts communication between a user and a website to capture passwords and other sensitive information. This can be done through methods such as malware, ARP poisoning, and DNS spoofing.

Pass the hash attacks

In a pass the hash attack, an attacker captures the hashed password from a compromised system and uses it to authenticate to other systems without needing to crack the hash back to the original password.

How to prevent credential stuffing and password spraying

Preventing credential stuffing and password spraying requires a combination of security measures and best practices. Here are some best practices to help protect against these types of attacks:

• Use a password manager: Require employees to use a password manager to generate and store strong, unique passwords for each of their accounts. This can help prevent password reuse and make it easier for users to manage their passwords securely.
• Implement multi-factor authentication (MFA): Require users to use MFA, which adds an extra layer of security by requiring them to provide two or more verification factors to authenticate their identity.
• Monitor for unusual login activity: Keep an eye out for signs of credential stuffing or password spraying attacks, such as multiple failed login attempts from the same IP address.
• Educate users about phishing: Phishing attacks are often used to steal credentials for use in credential stuffing attacks. Educate users about the dangers of phishing and how to recognize and avoid phishing attempts.
• Implement account lockout policies: Implement policies that temporarily lock out user accounts after a certain number of failed login attempts. This can help prevent attackers from using automated tools to guess passwords.
• Use CAPTCHA or other bot detection mechanisms: Implement CAPTCHA or other mechanisms to detect and prevent automated login attempts.
• Monitor the dark web: Monitor the dark web and third-party breaches for any leaked credentials associated with your organization. If credentials are found, prompt users to change their passwords immediately.

Summary

Both methods are very effective in account takeovers. While the mechanics of the attacks differ, both provide threat actors with unauthorized initial access to their victims’ accounts.

One of the biggest blindspots businesses face is visibility into their employees’ leaked credentials. The reason for this is that it’s the easiest way for malicious actors to access their target’s network. In fact, 86% of breaches use stolen or weak passwords.

If your security team needs visibility into your organization’s leaked credentials, book a demo to learn how Breachsense can help.