100% account overtake repellent

Someone found a list of usernames & passwords on the internet and started to check a million stolen credentials against your login form, trying to steal your users’ accounts. It works because people often reuse passwords across different sites. What happens next depends on your application’s capabilities: the successful attacker may be able to steal personal data, send spam, change a settlements bank account, etc…

You’d think it is hard to pull this kind of attack? Not at all, user/pass pairs (combos in hacker jargon) are easily found on the open internet, a script to test them against a site takes just a few lines of code and there are even applications that automate everything.

How to deter credential stuffing

Anyone launching this kind of attack needs:

• a pool of proxies, otherwise they’d be caught immediately after a dozen continued attemps
• a simple script if the target backend doesn’t perform checks, or automated browsers if it requires the results from JS on the page

Site operators dealing with this problem for the first time often try to get rid of it with the least effort (who doesn’t?) and may block some datacenter IP ranges or a few specific User-Agents they’ve spotted in the logs. This quickly backfires because it blocks legitimate VPN users and some corporate traffic, plus most attackers nowadays use residential and mobile proxies which are indistinguishable from regular traffic.

Indistinguishable unless you know where to look. At Truesign we’ve developed technology that:

• detects proxies analyzing their network patterns in real-time
• associates seemingly unrelated requests to the single bad actor behind the proxies, guaranteeing no legitimate user gets mistakenly associated

Equipped with this additional information, blocking a volumetric proxy attack without impacting real users becomes much simpler. That’s what our continuous traffic monitoring achieves, and with one switch on our dashboard you can automatically shut down all requests tied to the attack.

There are multiple ways to integrate with Truesign on your web page. Let’s say you actually have a login <form>, then you simply embed our invisible.js on your page and blocked login attempts won’t even submit, guaranteeing requests that reach your server with a token attached comply with your rules.

<!-- annotate your form with the siteID you created on Truesign -->
<form data-truesign-id="123456789" action="...">
  <input name="email" type="email" />
  <input name="pass" type="password" />
</form>
<!-- embed our JS tag -->
<script src="https://edge.truesign.ai/v2/invisible.js"></script>

A picture speaks more than a thousand words

We ourselves receive these attacks pretty often, and we naturally employ our own technology to protect all our public endpoints, including the login form.

Below is the outcome from one of these attacks a few days ago:

Since the requests come through proxies, they are marked as suspicious from the first attempt. Soon, the site is automatically declared under attack and all requests launched by the attacker blocked.

You can tell how the attacker pauses after realizing the blockage, tries to rearm by updating their scripts and switching proxy pools repeatedly, but the attack is already identified and new attempts are immediately blocked each time. The attacker finally gave up and went to try another, less protected site.

What takes days to discover and deter (usually affecting random legitimate users!) took 0 man-hours on our side and caused 0 annoyed users, thanks to our 24/7 monitorization.

Technology is the key

At Truesign we’ve sharpened our systems during years of dealing with all types of fraud and abuse. We’re able to detect all kinds of volumetric attacks such as card testing, scalping, ad fraud and account overtake. Check out our self-published detection metrics.

Other vendors pay attention to your traffic only after signing a five-figure enterprise contract. With us you get continuous monitoring even on Free. Join us and see for yourself!