Identity-based fraud and ATO attacks

Gunnar Peterson at Forter explains why Account Takeover Attacks are at the top of the list and why it is important to fill the critical gap between static authentication and dynamic attackers

 

Digital identity is the new currency, and adversaries are chasing wealth. Research shows that 61% of data breaches are the result of compromised credentials. This is a common fraudster tactic, whereby using legitimate credentials allows them to avoid detection as they gather intelligence and stolen data that will allow them to undertake further fraudulent transactions.

 

Fundamental to the defence of systems is access control, but it has its limits. Attackers are continuously trying to circumnavigate these systems to access accounts, with login and payment flows frequently targeted. This is why many organisations have invested in anti-fraud technologies to detect and mitigate against such attacks.

 

However, fraudsters’ tactics can work equally as well when they target identity systems, such as provisioning, device, enrolment and password reset systems. Establishing the basis for access control, these systems are quickly becoming a fraudster favourite.

 

Fraudster tools and tactics evolving rapidly

Previously, fraudsters would take advantage of user credentials available on the dark web, compromised in data leaks or breaches, without any guarantees that the accounts held any value. Bad actors also lacked crucial intelligence that enabled them to observe the behaviour of legitimate account holders, as to avoid detection upon illegally accessing these accounts.

 

However, we’re now witnessing ransomware groups such as LockBit, Avaddon, DarkSide, Conti, and BlackByte utilising initial access brokers (IABs) to purchase access to data from vulnerable organisations on dark web forums. IABs have recently grown in popularity, as sourcing identities becomes easy and affordable. This demonstrates how business-savvy dark web fraudsters are becoming.

 

Identity-related attacks on the rise

Recent attacks and extortion attempts, such as those targeting Okta and Microsoft, illustrate how damaging account takeover (ATO) attacks can be. ATO is now the top choice for many fraudsters, with recent research revealing that attacks soared by 148% from 2020 to 2021.

 

The Lapsus$ ransomware group conducted all of its ATO activity using stolen credentials, with these groups continuing to purchase compromised data, preferably with source code access.

 

While all online accounts are vulnerable to ATO fraud, threat actors naturally go after ‘crown jewel’ targets, such as bank accounts and retail loyalty accounts, which have both monetary value and stored payment information. To do this, fraudsters typically use automated tools such as botnets to enact continuous attacks, such as credential stuffing and brute-force attacks, against high value targets, as shown by Lapsus$.

 

Other fraudster tactics include phishing, call centre scams, man-in-the-middle attacks, and an approach known as ‘click farms’, whereby fellow threat actors are employed to manually enter login credentials, enabling attacks to go undetected by tools tracking automated logins.

 

These methods enable fraudsters to operate at scale, vastly increasing their chances of obtaining compromised personally identifiable information that can be used to illegally access user accounts.

 

Access control layers no longer enough

Historically, access control implements authentication and authorisation services to verify identity. Authentication identifies users, with authorisation determining what they should be allowed to do.

 

Whilst these were previously considered to be a good first line of defence against identity-based fraud, they can now be easily bypassed. Fraudsters are continuously looking to infiltrate organisations’ systems at the intersection of security and usability.

 

However, this doesn’t mean that defence tools should reciprocate; looking solely at making systems extremely secure, or very easy to use, will compromise the other attribute.

 

Identity-based defence systems required

Organisations therefore require a second security layer. A robust, automated detection and mitigation solution should be deployed to block increasingly sophisticated and dynamic attack methods.

 

One option is to look at identity-based tools that can collect billions of consumer personas and behaviour patterns. This enables security teams to identify unusual user account behaviour in real-time, including automated bot activity.

 

Adopting tools that employ machine-learning algorithms that can ‘learn’ user behaviour, will enable organisations to recognise fraudster tactics across the entire identity life cycle, including provisioning and account maintenance, will help to protect data before its compromised and sold to the highest bidder.

 

Ultimately, to succeed against dynamic cyber criminals, organisations must think like their primary adversaries, and adopt systems that can prevent their customers’ identities from falling into the wrong hands.

 

---

 

Gunnar Peterson is CISO at Forter

 

Main image courtesy of iStockPhoto.com