API Security Webinar - Security Guidelines for Providing and Consuming APIs by Alexander Marcel Simak penjelasan dari pakar industri tentang trend dan tantangan API dalam tahun 2021. Pelajari bagaimana organisasi dapat membebaskan potensi API, untuk secara efektif menangkis serangan dan melindungi aset API. Masalah-masalah yang muncul di event API Security Challenge juga akan dibahas di sini, dan akan ada hadiah-hadiah menarik bagi semua peserta. Agenda : - Penelusuran trend keamanan API, tantangan dan masalah-masalah keamanan yang sering dihadapi. - Temuan dan Statistik yang dipelajari lewat API Security Challenge - Penelusuran solusi untuk tantangan nyata yang ditemui dalam API Security Challenges - Pengumuman pemenang API Security Challenge

1. | ©2021 F5 NETWORKS
1
June 2021
Alexander Marcel
Credential Stuffing

2. “Credential Stuffing is super effective because it takes
advantage of human behavior where majority is using
same password for multiple services”
CREDENTIAL STUFFING
cre.den.tial stuff.ing
The replay of a breached username/password
pairs across sites to find accounts where
passwords have been reused.

3. | ©2021 F5 NETWORKS
3 Confidential / / Part of F5
Get Credentials
Automate Login
Distribute Globally
Defeat Automation Defenses (if any)
1
2
3
CREDENTIAL STUFFING
4
cre.den.tial stuff.ing
The replay of a breached username/password
pairs across sites to find accounts where
passwords have been reused.
STEPS OF CREDENTIAL STUFFING

4. CREDENTIAL STUFFING
Step 1
Get Credentials

5. CREDENTIAL STUFFING
Step 2
Automate Login
No user interaction
No device or browser
spoofing
Poor device/browser
spoofing
Excellent device/browser
spoofing

6. CREDENTIAL STUFFING
Step 2
Automate Login
* No programming skills required. Create script in visual constructor.

7. CREDENTIAL STUFFING
Step 2
Automate Login

8. | ©2021 F5 NETWORKS
8 Confidential / / Part of F5
CREDENTIAL STUFFING
Step 3
Defeat Defenses (if any)

9. CREDENTIAL STUFFING
Step 3
Defeat Defenses (if any)

10. CREDENTIAL STUFFING
Step 3
Defeat Defenses (if any)

11. CREDENTIAL STUFFING
Step 3
Defeat Defenses (if any)

12. CREDENTIAL STUFFING
Step 3
Defeat Defenses (if any)
What about 2FA ?
2FA does not stop Credential Stuffing
2FA stops automated account takeovers.
The point of credential stuffing is to find valid accounts.
Credential stuffing, even with 2FA, still results in valid accounts.

13. CREDENTIAL STUFFING
Step 3
Defeat Defenses (if any)
How can attacker bypass 2FA ?
1. Social Engineering
2. Phising (RTPP)
3. Sim Swapping
4. etc..
472618

14. CREDENTIAL STUFFING
Step 4
Distribute Globally

15. | ©2021 F5 NETWORKS
15
Attack Kill Chain
Stolen
credentials
Botnets,cloud
hosting,proxies
Loginbehavior
simulationtools
CAPTCHAsolving
tools
starting: $0 $2 per 1000 IPs $50 per site config $1.39 per 1000
Because resources are cheap and widely available, it can cost just $200 to takeover 1000 accounts
via credential stuffing.

16. CREDENTIAL STUFFING
Call To Action for
All Users
1. haveibeenpwned.com
2. Make your passwords unique
3. Use password manager
4. Enable 2FA
5. Review your social media privacy setting
and so on.. please check securitycheckli.st

17. CREDENTIAL STUFFING
Call To Action for
IT Security
&
Anti Fraud Team
alexander.marcel@f5.com

18. | ©2021 F5 NETWORKS
18
Thank You & Stay Healthy