Anatomy of Account Takeover Attacks
Account takeover (ATO) describes a scenario where user accounts and password integrity have been compromised, enabling a third party to take your accounts and impersonate you. Account takeovers can have severe consequences, and they require so many resources to fix. Throughout this article, we shall discuss this cybercrime in depth, advising you on the best measures to take before any harm is done.
Prevalence of Account Takeovers (ATOs) in Our Society Today
We are all vulnerable to this cybercrime, and, considering the number of tasks we have automated, your odds of being the next victim are pretty imaginable. ATO was placed as one of the top three reported fraud cases by the MRC 2019 Global Fraud Survey. In that same year, ATO accounted for over $4 billion in losses, most of which belonged to users that had not logged in for more than 30 days.
Usually, the affected victims are the first to detect account takeover. A user may discover changes on their monthly statements or be notified of charges they had not authorized.
How Account Takeover Happens
There are a variety of ways your account can be compromised. Here is a brief explanation of various popular methods that hackers can use to steal your credentials.
- Credential Stuffing – This is a type of cyber-attack where account details (specifically, usernames and passwords) are stolen. These kinds of attacks are automated through large-scale login requests directed at a web application.
- Online Hacking – Whether intentionally causing harm or just doing it for fun, hackers and crackers run the show when it comes to data theft. Said individuals use malware such as key loggers to track the keyboard input of data so as to steal them.
- Phishing – This kind of cybercrime is typically characterized by email spam. To this day, email is the most targeted internet service, with the most potential for identity theft. Malicious individuals may pose as your bank and ask you to update your account passwords as part of security protocol, hoping you’ll unsuspectingly fall directly into their trap.
- SIM Card Swapping – SIM swapping is a legitimate service offered by phone companies when a user switches phones and the new device is not compatible with the SIM card. Fraudsters can manipulate this whole process by transferring a victim’s phone number to a new SIM card. Afterward, they can contact the mobile phone carrier and convince the call center to port the mobile phone to the illegal phone number.
How Is an Account Takeover Attack Performed?
There are four cycles in the lifecycle of an account takeover attack.
- Credential Acquisition – The first step is getting ahold of a target’s account names and passwords. There are several methods for acquiring them, as explained above. Also, due to massive data leaks and breaches, there are billions of data credentials being traded on the dark web (part of the web that is not indexed by search engines).
- Credential Testing - Regardless of the means an attacker has taken to acquire username-password combinations, the next probable step is to test them. Testing can be done manually or automatically through the use of bots.
- Action – At this stage, either the logins worked or they did not. Assuming they were accurate, the hacker can now choose to manipulate the seized accounts. Money could be withdrawn from bank accounts, scams disbursed over celebrity socials, and so on – depending on the type of account. Likewise, some hackers could simply choose to sell these credentials on the dark web.
- Consecutive Attacks – We have all been guilty of reusing one or two passwords all over the internet. This quickly puts us in harm’s way, as one or more of the passwords can be seized. For example, a criminal may attack your bank account, withdraw funds, and then attack your personal accounts like Netflix, possibly changing your passwords.
Are Organizations Able to Manage ATO?
Most cybercrimes that affect organizations can be controlled by using special applications and software. Managing account takeovers is challenging because it preys on the intrinsic nature of human error. Customers create these chances that expose them to attacks. Unfortunately for organizations, if an attack were to happen, they are still the ones whose reputation gets tarnished, although the customers are to blame.
An organization’s ability to manage customer account takeover is limited. Biometric authentication is, however, the best probable solution so far.
How Can an Organization Detect Account Takeover Fraud?
This kind of attack is subtle in most cases, but it can be detected with keen deliberation. The most crucially affected are bank systems, and they could use fraud detection systems for protection.
Fraudsters typically hide behind the character of their victim, trying to imitate normal login behavior. A fraud detection system allows a bank to closely monitor a user’s activity before, during, and after any specific transaction. For example, before a criminal can steal your money, they need to perform tasks such as setting up a new payee. Active monitoring of these activities will help detect any suspicious behavior in a timely manner, allowing for a call to action.
Effective detection systems are also able to narrow down where transactions are being carried out, geographically. For example, if the legitimate user withdraws some funds from Europe, it’s highly suspicious to detect the same user, ten minutes later, online shopping and paying from America. Once the risk has been identified, the detection system will prompt the users to authenticate themselves over 2FA before proceeding. Failing to do that, the legitimate user is notified, and consecutive protection measures are implemented.
Methods to Protect Yourself from Takeover
There are various precautions you can take to keep yourself safe from this type of harm. Among them are:
- Constantly changing passwords on your user accounts. This helps minimize the risk of your accounts being compromised by someone who previously got ahold of your account information from earlier attacks;
- Avoiding using the same password throughout your various account will help reduce your odds of being compromised repeatedly;
- Multifactor authentication is a helpful tool to manage your accounts and hinder any foreign login attempts;
- Avoid, as much as possible, using public Wi-Fis in airports, bars, or hotels for critical transactions. If you have to, always use a VPN for more safety;
- Do not share any personal information online. People will approach you impersonating organizations of which you are a member, trying to extract private information from you. Be careful about who you share with. In case of any doubt, you should instead call the organization or visit the physical premises for clarity;
- Remain physically secure. Shred all crucial documents after their use, avoid carrying your social security card in your wallet, and lock your mailboxes.
How Organizations Can Help Manage Account Takeover Attacks
The effort to protect yourself from credential theft is a two-way process. As customers, we should incorporate safe practices that do not expose us to harm. Similarly, organizations have a task to fulfill when it comes to this cybercrime.
The following are types of measures that organizations can use.
- IP-Block Listing – If a system recognizes one IP address trying to gain access to an account hundreds of times, that is a red flag. Persistent login attempts over a short period of time could indicate a brute force attempt to guess passwords.
- Login Attempt Limits - Another safety precaution is setting a finite number of allowed attempts before logging into an account. This method is particularly helpful against bot spamming and credential stuffing.
- Sandboxing - A web application firewall may be set up and configured to stop any subsequent activity to an account once illegal access has been detected.
- CAPTCHA – This authentication measure helps prevent further logins in case a bot successfully matches the account credentials. Although advancements in AI, browser plugins, and CAPTCHA forms can answer these CAPTCHA tests, they still are useful in the fight against crime.
- Customer Education – Above all else, knowledge is power. Educating your customers extensively on what to look out for and avoid is the easiest way to achieve protection.
- Dedicated Bot Mitigation – Bot mitigation and anti-automation is a new field in cybercrime mitigation. The techniques used involve biometric identifications by analyzing interactions with the keyboard, mouse, screen, and touchpad. This mitigation method helps to identify if it is an actual human navigating the system or a bot.
Conclusion
The growth of digital communication and virtual data storage implies a large variety of entry points for attempts at gaining illegal access. The effects of this cybercrime could involve the full spectrum of seriousness. In the simplest essence, your Netflix account could be compromised and log you out. A hacker could also subdue your communication channel in far more critical scenarios, changing everything and making access impossible for the legitimate user. The repercussions involved require us to be proactive in the efforts explained above to prevent dire account takeover problems.
About Scirge
Scirge provides a unique approach to unveil and gain control over unmanaged third-party web accounts. Scirge tracks the websites employees use corporate email addresses to register on and log in to. Having a central dashboard of discovered accounts helps to reduce the risk of credential-related threats such as password reuse or account takeover (ATO). Scirge gives a level of control over SaaS usage to overcome Shadow IT. It also helps to ensure that your company complies with GDPR, CCPA, and other audit requirements.