Understanding Account Takeover – How Cybercriminals Gain Unauthorized Access 

The issue of account takeover (ATO) is getting worse for both consumers and companies. For users, it can lead to monetary and personal loss. For companies, it can strain customer relationships and cause brand damage.

Understanding how hackers gain unauthorized access can help reduce the threat. Read on to learn how attackers can use stolen credentials to attack multiple accounts and the best preventive measures that can be taken to stop them.

Identifying the Target

What is account takeover? Fraudulent use of user accounts by hostile actors to carry out a variety of malicious behaviors is one of the most pervasive and destructive cyberattacks. It may result in financial losses, harm to a company’s reputation and consumer trust, and expensive remediation and recovery operations, such as the price of identity theft insurance, the cost of credit monitoring, and the time required to look into erroneous charges.

Attackers exploit stolen credentials, including usernames and passwords or email addresses and phone numbers, to gain unauthorized access. These credentials are often leaked in data breaches or sold on the dark web to other threat actors.

Attackers then use automated bots to attempt logins with these credentials at multiple online destinations. This process, called credential stuffing, is particularly effective on sites that do not require barriers like multi-factor authentication.

After breaching an account, attackers leverage the victim’s behavior patterns to steal personal information, change account settings, reroute transaction details, and even empty the bank account. They also may use the account to make fraudulent purchases or cash in loyalty points. In addition, attackers can target a business account to deliver ransomware or other malware on the corporate network.

Despite the growing prevalence of cyberattacks, traditional methods such as old-fashioned phishing are an effective way for attackers to obtain usernames and passwords. Without safeguards like MFA, these credentials can allow an attacker to take over an account and perform various malicious activities.

In a typical account takeover attack, a cybercriminal begins with stolen credentials obtained via phishing or leaked in a data breach. They then test the credentials using automated bots that continuously try password and username combinations at popular travel, retail, finance, eCommerce, and social media sites.

Once they have a set of legitimate login credentials, they can use them themselves or sell them on the dark web to other threat actors to employ in account takeover assaults.

With so many changes to customer account information occurring daily, it can be challenging for security teams to identify which are legitimate and which are indicators of a successful attack.

That is why security systems must evaluate the full context of an account change to determine whether it is a simple account management request or if the new credentials are being used to perpetrate a risky attack.

Identifying the Credentials

While cybercriminals grow in number and sophistication, they still follow the same steps to access data illegally. They may hack into a company’s website or database to steal data like passwords or credit card numbers. Alternatively, they might use malware, ransomware, or credential-stuffing techniques.

Once a threat actor has a set of compromised credentials, they can attempt to expand their access to a network and gain administrator or service account privileges. They might also use tools like DNS tunneling, bypassing firewalls, and accessing sensitive information inside an organization’s systems.

Identifying these attack methods is critical to protect your assets and customers’ personal information if you are a business owner. For instance, consider implementing user entity and behavior analytics (UEBA) to create a baseline of normal network usage and monitor for anomalies such as uncharacteristic login activity at an unusual time or from an unfamiliar device. Your security team should be able to respond to these security alerts and revoke accounts immediately.

The hacker doesn’t choose a victim randomly. They’re likely to select a target because they responded to an ad, inadvertently downloaded malware, or crossed the criminal’s path through some other means. They might have a specific ax to grind, such as being a disgruntled employee or seeking revenge.

Once an attacker has taken over a user account, they are often in complete control. They can look at any information and impersonate other users on the system. They can even shut down the entire company’s system or demand a ransom to restore it. Fortunately, these types of attacks can be prevented by minimizing your company’s attack surface.

That includes ensuring that your public-facing applications are patched and updated regularly. In addition, using UEBA to detect unauthorized or malicious activity on your endpoints can help you reduce the risk of an attack. It would be best if you also made it difficult for attackers to use your systems by limiting the number of administrators and services they can access, including remote corporate networks.

Creating a New Password

A hacker’s goal in taking over an account is to access all the information it provides. It includes sensitive messages, photos and videos, financial information, banking account details, and credit card numbers. If the attacker is successful, they can also use the account to commit fraud against other victims.

Users are notoriously lousy at creating secure passwords known to criminals. A 2017 survey revealed that “123456” and “password” are the most widely used passwords. Criminals can easily brute-force a username and password to gain access to an account.

They can do this manually using a script or, more commonly, by running automated scripts that churn through thousands of different username and password combinations per second.

Cybercriminals can then take over users’ email and social media accounts, change their contact information, and even transfer money or rewards points. They can change and reroute the transfer information to steal funds if they access a bank account. In addition, if they can get the login credentials to an e-commerce site, they can make fraudulent purchases and steal customer data.

Once the criminal has control of an account, they can also try to reset the user’s password or security questions so they can access the account in the future. It can lead to unauthorized transactions, costing the merchant hefty authorization fees and even causing a chargeback from a primary processor.

The damage of an account takeover attack can be severe, both financially and for a brand’s reputation. It may result in a declining client base, brand loyalty, and recurrent income. Fraud detection solutions that provide visibility into the behavior of users before they log in, while they are logged in, and after they have successfully authenticated can help mitigate the effects of an ATO attack.

With the right tools, merchants can keep their legitimate customers happy by letting them change their passwords and other contact information without fear of fraudsters hijacking their accounts. At the same time, those tools can help stop fraudsters by evaluating each change and determining whether it is high-risk.

Testing the Credentials

Account takeover fraud, a form of identity theft, occurs when cybercriminals gain unauthorized access to personal or company accounts. These attackers use stolen credentials to hijack online accounts such as actual credit cards, banking, or shopping accounts.

They can then drain these accounts or resell the access they gain to other criminals. In addition, stealing these credentials allows criminals to steal and resell personal data such as names, addresses, phone numbers, credit and debit card information, and Social Security numbers.

Cybercriminals typically use leaked credentials collected via data breaches, phishing attacks, or even social media oversharing to take over an account. They test the credentials to see if they work by manually entering each username and password combination one by one or using bots that automate the process.

Once they identify a valid username and password combination, they can quickly log into an account and use the victim’s data for their benefit. For example, they can resell the verified account access to other criminals or abuse the site functions for profit, such as transferring money or buying products.

Criminals can also breach a corporate account and use it to steal business data or disrupt service delivery to customers. It can damage a brand’s reputation and hurt customer relationships and revenue. It is especially true when a company loses customers because of a breach that could have been prevented by more substantial password requirements and multi-factor authentication.

While businesses can address these issues after a breach, it is much easier and less expensive to prevent account takeover from occurring in the first place. Companies should urge users to update their passwords frequently, refrain from using passwords that are simple to guess, and implement 2-factor authentication wherever it is practical to do so to defend themselves against it.

They should also monitor their logs for suspicious activity and ensure that they have solid policies and practices to detect if an account has been compromised. A robust, automated threat detection platform can help identify and stop cyber threats to prevent account takeovers.