Credential Stuffing and Password Spraying

Credential stuffing is an automated attack that takes username/password pairs stolen from one data breach and tries them on other services. It exploits password reuse — if someone uses the same password everywhere, one breach compromises all accounts.

Billions of credentials are available for purchase on dark web markets and forums. Tools like Sentry MBA, SNIPR, and custom Python scripts automate testing thousands of credential pairs per minute across many services simultaneously.

Studies show 65%+ of people reuse passwords across multiple sites. A breach of a low-security forum can compromise the same user's banking, email, and corporate accounts if they reuse credentials.

Password spraying tries a few commonly used passwords (e.g., "Spring2024!", "Password1") against many accounts. Unlike brute force, it avoids lockouts by spreading attempts across many accounts with one password at a time.

Comparison:

• Brute force — many passwords against one account → triggers lockout
• Password spray — one password against many accounts → stays under lockout threshold
• Credential stuffing — known pairs from breaches → doesn't guess

Detection indicators:

• High volume of failed login attempts from many IPs
• Success rate suddenly higher than baseline
• Logins from Tor exit nodes, VPNs, or residential proxies
• Device fingerprints of automated tools
• Logins from geographically impossible locations

Spraying indicators:

• Many accounts with failed logins at the same time
• Failed attempts just below lockout threshold (e.g., if lockout = 5, see 4 failures per account)
• Same password attempted across many accounts

Key defenses:

• MFA — stolen credentials alone insufficient
• Breach password detection — reject known-breached passwords on registration/change
• CAPTCHA on login forms
• IP reputation — block known malicious ranges
• Device fingerprinting — flag new device logins

Defenses:

• Account lockout policies (with alerts)
• MFA required for all accounts
• Block common passwords with a deny list
• Monitor authentication logs for spray patterns
• Conditional access requiring additional verification for anomalous logins

Alerting users to logins from new devices or locations lets them self-report account takeovers instantly. Many services send "New login from [City, Device]" emails — users should review and act on unexpected notifications.

Troy Hunt's HaveIBeenPwned aggregates breach data. Organizations can integrate the HIBP k-anonymity API to check if passwords exist in known breaches — without sending the full password to the API.

An attacker tries "Summer2024!" against 50,000 accounts, then waits, then tries "Password1!" against the same 50,000 accounts. What technique is this?

Credential stuffing reuses stolen credentials from one breach against other services — enabled by password reuse. Password spraying tries common passwords across many accounts to avoid lockouts. Defenses include MFA, breach password checking, CAPTCHA, IP reputation blocking, and monitoring authentication logs for anomalous patterns.