The State of Credential Stuffing and the Future of Account Takeovers - Jarrod Overson
Channel: AppSec California
Date: 2020-02-22

https://appseccalifornia.org/

Credential Stuffing has existed since the first leaked password but has exploded in the past 3 years. Why? What has changed and where does it go from here?

The tools that enable credential stuffing attacks and other OWASP Automated Threats are converging on a single strategy, the complete imitation of user behavior and characteristics – real user behavior on real devices on real home networks. This level of extreme mimicry makes discerning good from bad difficult and the web is having a hard time keeping up.

This level of sophistication is not cheap and is only possible because the cost vs value of modern credential stuffing attacks is weighted dramatically in an attacker's favor.

After this session you'll:
- Understand the cost vs value of modern attacks and why the economics are driving greater sophistication.
- Learn how attacks have evolved and how attackers are bypassing all modern defenses.
- See how account takeover attacks are diversifying with other malware and why MFA is not a silver bullet.

Jarrod Overson
Director of Engineering, Shape Security
Jarrod is a Director of Engineering at Shape Security where he led the development of Shape's Enterprise Defense. Jarrod is a frequent speaker on modern web threats and cybercrime and has been quoted by Forbes, the Wall Street Journal, CNET among others.