One potential sign that a credential attack is ongoing is that login failure rates suddenly go up dramatically.Īt that point, if defenders spot the attack early, they can turn on across-the-board second factor authentication, or swap out the login page for one that hasn't been seen before. For example, to recognize keywords that indicate successful or failed login attempts. Working configurations for various websites are available in the criminal forums, and they specify in detail the location of the login pages and individual form fields, plus the rules for valid password construction and other details that make it possible for Sentry MBA to log into the site.įinally, attackers can customize their attacks further. In particular, attacks are custom designed for each website individually. 'These are tailored attacks that simulate human behavior.' 'These are not brute force attacks,' said Agarwal.

Sentry MBA comes with a graphical user interface that makes it possible for a criminal with very basic skills to create a very sophisticated attack, said Agarwal.

Hundreds of millions of stolen credentials are already available for sale on underground forums, a result of the recent wave of breaches. With Sentry MBA, criminals buy an off-the-shelf, ready-to-go solution and pair it with a list of stolen credentials. Building a botnet, stealing credentials from another site, bypassing CAPTCHAs and other security mechanisms are all difficult tasks.

Putting all these pieces together into a targeted attack against a particular organization is not a simple task for a would-be attacker. 'Anyone who's using a CAPTCHA to try to keep automation at bay is not even introducing a significant road block,' he said. But the attack traffic comes during regular business hours, domestic to the country where you do business in, from unwittingly compromised machines belonging to real users.'įinally, to get around CAPTCHA challenges, attackers use optical character recognition.Īccording to Ghosemajumder, every single CAPTCHA-type system has been shown to be vulnerable to optical character recognition attacks for the past several years. 'If they all came from a country where i don't even do business, that would be easy to defend.

'If they were coming from the same computer, it would be very obvious to defend against,' said Sumit Agarwal, Shape Security's co-founder and vice president of strategy.

Bibliocad sentry mba