Akamai State of the Internet Security Report: Retailers Most Common Credential Stuffing Attack Victim; Points to Dramatic Rise in API Traffic as Key Trend
The Company studied the credential abuse technique known as credential stuffing, where hackers systematically use botnets to try stolen login information across the web. They target login pages for banks and retailers on the premise that many customers use the same login credentials for multiple services and accounts. Interest in retail is driven by the value of merchandise, which hackers acquire through compromised accounts and then frequently resell.
According to the report, the insidious AIO bots that hackers deploy are multi-function tools that enable quick purchases by leveraging credential stuffing and a number of evasion techniques. A single AIO bot can target more than 120 retailers at once.
Media & entertainment properties are notable credential abuse victims as well, according to the report. Their value is in the personal information those sites maintain. End users share credit card information and demographic data when they sign up for over-the-top (OTT) online streaming services, for example. This type of data has high value on the black market.
"The techniques change, but the motivation remains the same: greed," said
Within the retail industry outside of the apparel vertical,
API Traffic Prevalence and
API calls represent 83 percent of web traffic, according to an
"The state of web applications is fluid, and many API calls are application or company-specific and require a different security approach than HTML traffic, which is seemingly static," McKeay explained.
Meanwhile, DNS traffic analysis outlined in the report notes that IPv6 traffic might be underreported, since many systems capable of IPv6 usage still prefer IPv4. This could indicate device misconfiguration or improper monitoring and network blind spots, a security concern. Since IPv6 is still believed to be a minority of web traffic, it is not a major selling point for a number of security tools.
A complimentary copy of the 2019 State of the Internet / Security: Retail Attacks and API Traffic report is available for download here. For additional information about credential abuse—specifically credential stuffing—and advice for organizations facing these types of attacks, visit here. For information about other
Methodology
The
About
Contacts: |
|
Tim Whitman |
Tom Barth |
Media Relations |
Investor Relations |
617-444-3019 |
617-274-7130 |
twhitman@akamai.com |
tbarth@akamai.com |
View original content to download multimedia:http://www.prnewswire.com/news-releases/akamai-state-of-the-internet-security-report-retailers-most-common-credential-stuffing-attack-victim-points-to-dramatic-rise-in-api-traffic-as-key-trend-300802535.html
SOURCE