Wave Systems Corp. (fka WAVXQ)

[Genz2]

Credential-Stuffing Attacks Behind 30 Billion Login Attempts in 2018

https://www.darkreading.com/threat-intelligence/credential-stuffing-attacks-behind-30-billion-login-attempts-in-2018/d/d-id/1334371

Using e-mail addresses and passwords from compromised sites, attackers most often targeted retail sites, video-streaming services, and entertainment companies, according to Akamai.


Credential stuffing — where attackers use e-mail addresses and passwords stolen from one site to attempt to access other sites — took off in 2018, with nearly 30 billion documented attempts recorded by Internet infrastructure firm Akamai, according to its new report.

The attacks are enabled by easy-to-use software and widespread botnets that can take lists of usernames and passwords and try to log into a variety of sites. On average, Akamai saw more than 115 million attempts to use stolen credentials per day, and three times during the year the attacks spiked to more than 250 million attempts per day.

The widespread attempts to log into a variety of services mean that companies need to be on watch, says Martin McKeay, a security researcher and editorial director at Akamai.

"This is not something that just happens to someone else," he says. "This is not something that you can ignore. It is a constant problem."

Attacks that attempt to access sites using stolen or easy-to-guess credentials have become increasingly popular. In March, for example, the FBI warned management-software firm Citrix that attackers had breached the company's network using a low-volume credential-stuffing attack — known as credential spraying — where an attacker sends a relatively low number of attempts to each targeted server. Indoing so, the attacker can avoid triggering hard limits on the number of log-in attempts.

In its recent report, security firm Rapid7 also found that credential stuffing attacks had taken off, ostensibly because so many username-password pairs have been stolen from compromised sites.

"There are now upward of 1.5 billion credentials floating in the wild ready for use by malicious miscreants at an exposed service near your data," the company stated.

Akamai found that attackers most often targeted retail sites, video-streaming services, and entertainment companies. Because the company defined a credential-stuffing attack as a log-in attempt using an e-mail address, financial firms did not show up often in the data set, as most financial firms do not allow customer to log in with an e-mail address.

Online groups are after all sorts of credentials, McKeay says.

"They are looking at getting your streaming credentials, and they are looking for your gaming credentials — there is a large market for these things," he says. "If they can go and prove that what they have is a valid set of credentials, there is money to be made there."

The popularity of credential-stuffing attacks is also driven by easy-to-use software, the Akamai report stated. A tool named SNIPR is a popular entry-level program for targeting the simplest targets, such as gaming networks and video-streaming services. Another tool, known as STORM, allows for custom configurations that are traded and sold on the Dark Web, according to Akamai.

Other tools are designed to test stolen credentials' validity. Credentials proved to be valid have a much higher value in online black markets. In January, security researchers found a collection of 773 million e-mail addresses and 21 million passwords for sale on the Dark Web.

Intuit warned users of TurboTax in February that the reuse of usernames and passwords had allowed attackers to compromise an unknown number of accounts.

"Based on our investigation, it appears that an unauthorized party may have accessed your account by using your username and password combination that was obtained from a non-Intuit source," the company stated in a letter sent to consumers.

Akamai urged companies to continue to educate users on the reasons for using unique passwords paired with a password manager. And users should request two-factor authentication whenever a service offers the security measure.

"When discussing [attack takeover] and [all-in-one] scripts, criminals often complain about the use of multifactor authentication, which is a particularly effective method of stopping most of their attacks," the company stated in its report.
==================================================================
https://www.wavesys.com/products/wave-virtual-smart-card

Get better security at less than half the cost

Passwords are weak. Tokens are expensive. Don’t compromise on security or price.

Wave Virtual Smart Card does anything your physical smart cards and tokens do, but it starts with hardware you already have: the Trusted Platform Module (TPM), a hardware security chip built into the motherboard of most business-class PCs. You may not even know you have it, but once you do, the TPM can be used in a myriad of ways. Wave turns it into a smart card, embedded directly into your laptop.

What can it be used for?

What do you use your smart card for today? With the exception of keying open the door at work, Wave Virtual Smart Card can perform any of the services or applications you rely on your smart card for today. Secure VPN, WiFi, remote desktop, cloud applications – it can all be done with a virtual smart card.

One helpdesk call you'll never get: "I lost my virtual smart card again..."

There are so many ways to lose a token – couch cushions, street drains, curious toddlers. In fact, up to 30% of all tokens are eventually lost. It’s much harder to lose a laptop, and you notice a lot faster when you do.

The user experience with a virtual smart card is simple: he or she logs in with a PIN (authentication factor number one). The TPM (authentication factor number two) then transparently identifies the device to the network and connects the user to all the approved services. It’s one less thing for users to carry around.

What will you do with >50% TCO savings?*

Tokens and smart cards require an additional hardware purchase, plus the time and money to ship to remote users. Use something that’s already in the users’ hands (the TPM), and your acquisition and deployment costs are lower.

Then consider the management savings in not having to replace lost and stolen tokens. That means fewer helpdesk calls, less interruption of user productivity, and fewer acquisition and shipping costs.

When we say “secure”…

…we mean it. Our solution starts with a proven hardware root-of-trust. Multi-factor authentication is an established best-practice for strong authentication: the TPM-based virtual smart card is one factor (something you have) and the user PIN is a second factor (something you know).

*Actual number may vary. Contact us today to receive more details and a free quote.

Key Features:

• Full lifecycle management of virtual smart cards
• Intuitive interface to create (or delete) virtual smart cards
• Command line option to create and delete virtual smart cards
• Flexible PIN policies
• Helpdesk-assisted PIN reset and recovery
• Generates reports for compliance
• Integrates with Active Directory
• Supports familiar use cases ? Virtual Private Network (VPN)
? Local logon
? Remote logon
? Remote desktop access
? Intranet/Extranet
? Cloud applications

=================================================================
https://www.wavesys.com/products/embassy%C2%AE-remote-administration-server-tpm-management

Excerpts:

Token-free, password-free user authentication

We know you’ve dreamt about shredding your list of passwords. Go on and do it.

Because you are starting the authentication process in the device’s hardware, the user doesn’t have to interact with it. All users see is their usual Windows log-in screen – no more additional passwords to access the VPN or other resources. They just sign in once, and the secure credentials in their TPMs securely and quickly connect them to everything they need. Say goodbye to user frustration and slow OS performance.

Decrease expenses with virtual smart cards

You know what else happens when you take passwords out of the equation? A lot fewer calls to IT. Imagine if you took password resets out of the picture – that frees up a chunk of IT time, lowering your operating expenses significantly.

If your organization currently uses traditional tokens or smart cards, switching to virtual smart cards takes an even bigger burden off of IT – we use the hardware-protected credentials in the TPM to create a virtual smart card, which performs the same functionality as traditional smart cards. That means no need to purchase, deploy, replace or maintain external tokens, smart cards or smart card readers. Because virtual smart cards are already on your machines and can’t be forgotten, lost or stolen, you have lower capital expenses and lower operating expenses.

Wave's is the only management to support virtual smart cards on Windows 7, as well as Windows 8 and 8.1.

Key Features:

Strong Security
• Authenticate securely, encrypt email, and prove integrity of the device with one management console
• Protect against phishing, malware and other network security threats by storing authentication credentials in hardware
• Provide centralized enforcement of custom policies

Low TCO
• Reduce operating expenses by eliminating password reset and shortening deployment times
• Minimize capital expenses by using hardware you already have
• Integrate with Microsoft Active Directory for IT familiarity

Superior User Experience
• No more tokens or smart cards to achieve two-factor authentication
• Eliminate VPN/WiFi/website passwords for faster access to resources
• No add-on software means improved OS performance

Flexibility
• Compatible with Windows 8.1, 8, 7 and Vista operating systems – manage mixed environments from one console
• Create custom management policies to suit your organization’s needs
• User and device authentication from a common console

Seamless Device Authentication
• Access control over wireless (i.e. 802.1x)
• Single sign-on
• VPN authentication (i.e. Microsoft DirectAccess)