4 ms·
Can service providers not realize that someone is trying millions of different accounts with patterns of passwords and throttle or block them?
by ALittleLight 7y ago
Can service providers not realize that someone is trying millions of different accounts with patterns of passwords and throttle or block them?
- samsquire 7y agoThis assumes that people have good monitoring over the login pages/endpoints.
- mandelbrotwurst 7y agoA company as large as Zoom should have this kind of monitoring over auth endpoints.
- bigiain 7y agoThere are many recent reports about things Zoom "should have" that they don't. The assumption of rank incompetence and/or irresponsible cowboy practices seems to be completely appropriate for them...
- weej 7y agoIt also assumes malicious request have same or similar signature attributes (ex: IP addr, http hdrs), which is not always the case.
- rad_gruchalski 7y agoThey probably could. Assuming that these attempts aren’t executed using a botnet with dozens of thousands of machines.
- aaronblohowiak 7y agoHow many logins/second from how many different IP addresses and browsers would you have to try in order to achieve this in a way that is hard to detect? How hard is it to rent a botnet that would mean IP-based filtering would have too large a blast radius?
- gruez 7y agoYou don't even need a botnet. There are companies that offer such service out in the open. eg. luminati
- judge2020 7y agoCred stuffing can often be done with 5 or less "known" passwords used by the victim. When the attackers have enough IPs (via proxies or cloud providers - remember that most cloud providers give out multiple ipv6 /64s no questions asked), It'll end up looking like any other login attempt from a consumer VPN where the user forgot their password and is trying 3 or 4 different ones.
- ALittleLight 7y agoI would think you alarm when login failure rate spikes. Realize what is going on, list the probably affected accounts, and lock those accounts until they change their passwords. Doesn't seem like an impossible to mitigate problem.
- majormajor 7y agoNot that easily. A sophisticated attacker is going to be using a lot of different throwaway IP addresses. One of the common ways to (try to) prevent this are often how you end up with stuff like "all IPs we think are AWS or data centers or [...] are blocked from our service."