Slashdot Mirror
Hackers Account For 90 Percent of Login Attempts At Online Retailers (qz.com)
Hackers account for 90% of of e-commerce sites' global login traffic, according to a report by cyber security firm Shape Security. They reportedly use programs to apply stolen data acquired on the dark web -- all in an effort to login to websites and grab something of value like cash, airline points, or merchandise. Quartz reports: These attacks are successful as often as 3% of the time, and the costs quickly add up for businesses, Shape says. This type of fraud costs the e-commerce sector about $6 billion a year, while the consumer banking industry loses out on about $1.7 billion annually. The hotel and airline businesses are also major targets -- the theft of loyalty points is a thing -- costing a combined $700 million every year.
The process starts when hackers break into databases and steal login information. Some of the best known "data spills" took place at Equifax and Yahoo, but they happen fairly regularly -- there were 51 reported breaches last year, compromising 2.3 billion credentials, according to Shape. Taking over bank accounts is one way to monetize stolen login information -- in the US, community banks are attacked far more than any other industry group. According to Shape's data, that sector is attacked more than 200 million times each day. Shape says the number of reported credential breaches was roughly stable at 51 last year, compared with 52 in 2016. The best way consumers can minimize these attacks is by changing their passwords.
The process starts when hackers break into databases and steal login information. Some of the best known "data spills" took place at Equifax and Yahoo, but they happen fairly regularly -- there were 51 reported breaches last year, compromising 2.3 billion credentials, according to Shape. Taking over bank accounts is one way to monetize stolen login information -- in the US, community banks are attacked far more than any other industry group. According to Shape's data, that sector is attacked more than 200 million times each day. Shape says the number of reported credential breaches was roughly stable at 51 last year, compared with 52 in 2016. The best way consumers can minimize these attacks is by changing their passwords.
Hackers keep trying different variations, usually using bots. The quantity does not surprise me.
Table-ized A.I.
The Kohl's web site is utterly broken. Every time they have a sale, your account gets locked due to too many password attempts. You literally have to reset your password almost every time you use it. Why you would lock an account entirely instead of rate limiting it blocking the overseas IP addresses involved, I have no idea.
That his toupee size?
Table-ized A.I.
And has no surprise-factor at all. Basically anything that accepts log-ins from the Internet gets between a few and a few 1000 every minute. This may or may not get better with IPv6, but with IPv4, the whole net is scanned all the time.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I owned the company that built the login system which was used by most of the successful porn sites (as well as other sites), so I had opportunity to analyze many millions of attempts. 90% or higher seems about right.
Only 90%??
The best way consumers can minimize these attacks is by changing their passwords.
No, that is not necessarily the best way. Why this unsubstantiated claimm?
Not creating an account in the first place and using a guest checkout is arguably better. So is switching to sites that offer better protection, like 2-factor authentication or having to call in the CVV.
There are so many hack attempts, that when I try to create a new account, the first email I receive tells me that my account is locked due to too many failed logins.
--
Whats up doc? - B. Bunny
I'm not sure I believe the problem to be as bad as people are making out.
I shop online for almost everything because I live out in a very rural area. There are no local stores. As a result I have accounts at a great many online retailers. I have not had problems.
I'm not saying the problem doesn't exist, just that I think it is getting exaggerated.
I also have an online store for my business. I have no cases of hackers doing login attempts or trying to purchase other than the obvious ones which get filtered out automatically before they ever get to the purchase. I'm just a little guy. I'm sure the big stores use far better filter technology.
I periodically analyzed samples, a few hundred thousand here, a few there. The cracker sites and forums have lists that are commonly used, and there are a few common tools they which generate different permutations.
It should be easy to buy things online, but they keep making it harder.
Two step logins like Amazon has also allowed testing and probings of email addresses for address collection or confirmation. It aids hackers and spammers, while being an annoyance to users. No clue why they decided to go that route, but Amazon's made a lot of design and interface changes to theri website the past 2 years that have been largely questionable.
There are so many hack attempts, that when I try to create a new account, the first email I receive tells me that my account is locked due to too many failed logins.
Try picking a different username than phpadmin.
That's funny.
What IS true is that a perfectly logical security system, trying to determine whether a login attempt is legit, would start out with the knowledge there is a 90% chance it's not legit, before considering any other factors. Until we have evidence that it IS legit, it's probably not. That's called a prior probability. That has some interesting implications.
Fortunately, there are some pretty straightforward metrics to identify legit and bogus attempts with high success rates when the metrics are combined correctly.
Useful, relevant, informative reporting? Doesn't exist in BeauHD's book. It's gotta be empty, sensationalist, clickbait.
I'd funny mod you....
--
Username: phpadmin
Username: root
Username: admin
This is why Paypal's recent change to the always-logged-in model is a dumb idea. I'm certain that if banks claimed a phone had too much security (that is, a password), people would be changing banks.
I would have guessed attempted fraudulent logins would have accounted for closer to ninety nine percent.
First off, changing your passwords is a horrible strategy. Yes, you need to change them but more important is to salt them. Don't use the same password suffix on each site. Keep each password unique for each site. Second of all, retailers need to standardize on two factor authentication, like yesterday! This stops way more than 99% of all malicious login attempts. The attacker would have to no only know your password but also own access to your email or texting.