FB pixel

Okta report on credential stuffing attacks marks another blow against passwords

Automation, availability of stolen login credentials fuel attacks mirroring Cisco assault
Categories Access Control  |  Biometrics News
Okta report on credential stuffing attacks marks another blow against passwords

San Francisco’s Okta says a wave of credential stuffing attacks that is “unprecedented” in scale uses the same infrastructure as attacks on Cisco’s VPN services earlier in April. The trend is sure to reignite discussion about the dubious security of passwords and potential alternatives that use security keys or biometric authentication.

A post on the company’s blog, entitled “How to Block Residential Proxies using Okta,” says that “over the last month, Okta has observed an increase in the frequency and scale of credential stuffing attacks targeting online services, facilitated by the broad availability of residential proxy services, lists of previously stolen credentials (‘combo lists’), and scripting tools.” In credential stuffing attacks, bad actors with access to large lists of names and passwords obtained from data breaches use automation to try hundreds of login combinations in minutes.

Both recent rounds of attacks were deployed through and made possible by anonymizing services, notably TOR. “Millions of the requests were also routed through a variety of residential proxies including NSOCKS, Luminati and DataImpulse,” says Okta’s post. Residential proxies route IP data and authentication requests through a network of legitimate user devices, such as smartphones or routers, to anonymize them. Some users are aware their devices are being used as proxies, but others have had malware enroll devices in proxy networks without their knowing.

Okta says users should keep defense software up to date. “The unprecedented scale of these attacks has provided clear insights into the controls most effective against credential stuffing.

ThreatInsight, Okta’s built-in control against high volume attacks, blocks requests from IPs involved in large scale credential based attacks prior to authentication.”

In its recommendations, it encourages customers to embrace passwordless, require Okta FastPass and FIDO2 WebAuthn, and support passkeys as a preferred sign-in method.

Cisco’s parent company, Duo Security, recently migrated its membership in the FIDO Alliance to Cisco and joined the FIDO board. Cisco has been reorienting its security strategy around identity and AI to strengthen its defensive posture.

Industries across the board are following suit, with the auto industry showing particular enthusiasm for passwordless authentication. Data breaches keep happening, and fraudsters are getting better at using increasingly advanced tools. Passwords have hung on for longer than some expected. But if the current wave of credential stuffing attacks keeps swelling, expect password-based authentication to be subsumed soon enough.

Technical details on the attack can be found at the bottom of Okta’s post.

Related Posts

Article Topics

 |   |   |   | 

Latest Biometrics News


New FaceTec CLO among avalanche of appointments in biometrics and fraud protection

New executives have been named by biometrics providers FaceTec, Pindrop and Fingerprint Cards, along with C-level appointments by Prove and…


Indonesia issues call for World Bank-backed digital identification project

Indonesia is looking for a company providing consulting services as a part of its upcoming digital transformation project backed by…


Affinidi data sharing framework leverages privacy-preserving open standards

Affinidi, a company specializing in data and identity management, unveiled the Affinidi Iota framework at the WeAreDevelopers World Congress. This…


Sri Lanka set for January biometric passport launch, plans airport upgrades

Sri Lanka is preparing to begin issuing biometric passports with electronic chips embedded as of January, 2025, according to a…


Vending machines with biometric age verification roll out in Germany, US

Vending machines are growing in popularity as a way to sell age-restricted products around the world, with Diebold Nixdorf algorithms…


San Francisco police hit with lawsuit over facial recognition use

In 2019, San Francisco became the first city in the U.S. to ban facial recognition technology, forcing the police and…


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Most Read This Week

Featured Company

Biometrics Insight, Opinion

Digital ID In-Depth

Biometrics White Papers

Biometrics Events