Okta Warns of Credential Stuffing Attacks Using Proxy Services

Okta has issued a warning about the increasing prevalence of credential-stuffing attacks.

These attacks, which leverage stolen user credentials to gain unauthorized access to accounts, are facilitated by the widespread use of residential proxy services.

This alarming trend underscores the evolving challenges in cybersecurity and highlights the need for robust defensive measures.

The Rise of Credential Stuffing Attacks

From mid-March to late April 2024, cybersecurity teams at Duo Security, Cisco Talos, and Okta’s own Identity Threat Research team have observed a significant uptick in brute force and credential stuffing attacks.

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

These attacks are becoming more frequent and sophisticated, utilizing advanced tools and the anonymity provided by proxy services like TOR, NSOCKS, Luminati, and DataImpulse.

Credential stuffing attacks involve using large databases of usernames and passwords—acquired through previous data breaches, phishing, or malware campaigns—to attempt logins on various online platforms.

These recent attacks are particularly concerning because they rely on residential proxies, which use legitimate user devices to disguise the attackers’ origins, making the attacks more challenging to detect and trace.

Understanding Residential Proxies

Residential proxies are networks that route internet traffic through real users’ devices to anonymize the source.

These proxies can be a double-edged sword.

On the one hand, they provide valuable services like content localization and ad verification; conversely, they can be exploited for malicious activities like credential stuffing.

Deploying residential proxies often involves “proxyware” voluntarily installed by users or, more maliciously, through malware and compromised mobile apps.

This latter method enrolls devices into a botnet-like network without the owner’s knowledge, using them as conduits for illegal activities.

Okta’s Proactive Measures and Recommendations

In response to these threats, Okta has proactively enhanced its security features.

Earlier this year, Okta introduced a new capability in its Workforce Identity Cloud (WIC) and Customer Identity Solution (CIS) that detects and blocks requests from anonymizing services.

This feature is part of Okta’s broader strategy to implement default security measures that protect against such vulnerabilities.

For organizations using Okta’s services, the following measures are recommended:

• Enable the Early Access feature to block anonymizing proxies directly from the Okta Admin Console.
• Use Dynamic Zones for more granular control over which anonymizers are blocked.
• Consider upgrading the Okta Identity Engine for additional features like CAPTCHA challenges and passwordless authentication with Okta FastPass.

Furthermore, Okta advises all its customers to adopt a defense-in-depth approach.

This includes enabling ThreatInsight in log and enforce mode, which has proven effective in blocking IPs associated with high-volume credential-based attacks.

As cyber threats continue to evolve, staying ahead of attackers requires not only the use of advanced technological solutions but also a comprehensive understanding of the tactics employed by cybercriminals.

Okta’s ongoing efforts to enhance security and educate its users are vital in fighting credential stuffing and other forms of cyber aggression.

Combat Email Threats with Easy-to-Launch Phishing Simulations: Email Security Awareness Training -> Try Free Demo