Crush Cred Stuffing: A Method for Neutralizing Credential Stuffing Attacks
summary
Shows a repeatable method that turns logs into actionable signals: compute frequency distribution across IP, ASN, TLS JA3/JA3S, user‑agent, endpoint and form‑argument columns, then correlate timing deltas and request per second spikes. Real examples: a 1,000‑IP attack (baseline 80 RPS, peak 3,000, sustained 1,000 for six hours) and a 16,000‑IP run (baseline 20, peak 520, sustained 380 for 33 hours). Practical actions include ASN‑based blocking for concentrated botnets, collecting TLS fingerprints at the edge, enforcing MFA and automating lookback scripts to shut attacks down fast.
AI-written summary · about
chapters (15)
- 0:00Credential stuffing attacks
- 1:06Why credential stuffing matters
- 3:39Brute force vs credential stuffing
- 6:37Attack patterns and detection
- 10:11Frequency distribution analysis
- 12:18Key data points to track
- 16:36TLS fingerprints role
- 21:19User agents and endpoints
- 23:35Login argument patterns
- 25:03Neutralizing attacks
- 28:37Quick recap and closing
- 29:00Q&A: Rate limiting and IP diff
- 31:29Q&A: Vendor solutions and bots
- 33:41Q&A: Password storage and encryption
- 35:29Q&A: FIDO2 keys and MFA
related talks
40mYou have a security problem - your users
29mBecoming You: A Glimpse Into Credential Abuse
28mBlue Team Fundamentals
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
41mThe State Of Credential Stuffing And The Future Of Account Takeovers
42mCracking the Code: Decoding Anti-Bot Systems!
01h 00mRock ‘Em Sock ‘Em Robots: Bot Swatting Like the Pros
16mProtecting your application from bot attacks (PRT019)