return2ozmaGenetics firm 23andMe says user data stolen in credential stuffing attack
hamsterhttps://owasp.org/www-community/attacks/Credential_stuffing
Credential stuffing is the automated injection of stolen username and password pairs (“credentials”) in to website login forms, in order to fraudulently gain access to user accounts.
Since many users will re-use the same password and username/email, when those credentials are exposed (by a database breach or phishing attack, for example) submitting those sets of stolen credentials into dozens or hundreds of other sites can allow an attacker to compromise those accounts too.
So they brute forced the login?
No request limiting?
Wtf
Just because this method is a subset of the brute force attack doesn’t mean that they don’t have request limiting. They are reusing known breached passwords from other platforms, which makes it basically a guarantee that they will get the right password if they don’t use a password manager. Their computer systems are secure, it’s just their business model that’s a privacy nightmare.
I mean true, there’s nothing you can do with a successful attempt.
But i feel like this still could have been limited. Required 2FA obvi comes to mind… You can limit rate in a lot of ways.
According to the quote they would’ve used breached passwords. You don’t know anything about request limiting. It wasn’t just randomly entering passwords unrestricted, as per your own quote.
Okay 2FA then. Limit it somehow
Limits aren’t a concern if you’re controlling a bunch of zombies.
Mandatory 2FA.
Easy.