Why Is Russia Password Spraying Hurting You? How Are They Doing It? And How Will It Affect You?

-Episode 1157: Why Is Russia Password Spraying Hurting You? How Are They Doing It? And How Will It Affect You?

The Russians are using "Password Spraying" to attack businesses, individuals, and government agencies. They're being very successful doing it.

And you or your business are among their targets.​ And I'm going to tell you what you can do about it.​
​
These Russian hackers use more than 2 billion usernames and passwords stolen in data breaches to access accounts across the Internet. The hackers try and use these stolen credentials to get into bank accounts and companies. This technique is now one of the most common causes of data breaches.
​
Why does Password Spraying work?

It's simple.​​

​​65% of people reuse the same password on multiple accounts, so "stuffing" those stolen email addresses and passwords is very effective. Almost all of the login attempts to my clients' systems are "Password Spraying" attempts. Far more than legitimate employee logins.
​
What to do? Understanding the reasons for the attacks might help:
​
- Selling access to compromised accounts: This is particularly common for media streaming services. Disney+, Netflix, and Spotify have all been victims of attacks. Hackers sell access to user accounts for less than the cost of a subscription.
- E-commerce fraud: Hackers can impersonate legitimate users at retailers' websites and order a high-value product, either for use or reselling. According to research from Akamai, this is a common form of identity theft and makes retail the most vulnerable vertical for credential stuffing.
- Corporate/institutional espionage and theft: Suppose an attacker successfully hijacks an employee's account or, even worse, an admin. In that case, they could gain access to sensitive information, like Intellectual Property, credit card numbers, social security numbers, addresses, and login credentials. All sold to the highest bidders.

​Passwords Aren't Enough Anymore!
​
Multi-Factor Authentication adds another layer to password protection. As a result, it becomes more difficult for hackers to reach your sensitive data by providing layers to your security.

​​In addition, research suggests that firms that rely solely on passwords for cybersecurity are at a much higher risk of having their data hacked.
Multi-Factor Authentication depends on:
a) A long and strong password that the user can remember, i.e., something you know
b) A mobile device or hardware token for sending codes or One-Time-Passwords (OTPs), i.e., something you have
c) A biometric marker such as fingerprint, face, iris scan, etc., i.e., something unique to you​

​My advice: Use a strong password manager that includes creating, storing, and using strong passwords, OTPs, and your personal biometric information.
​
For a special report on creating and using Multi-Factor Authentication, just send an email to [email protected] and put "Multi-Factor Authentication" in the subject line.