Account Takeover

An Account Takeover (ATO) attack occurs when a malicious actor gains access to a user's account by guessing or obtaining the user's password or session token. Tools such THC-Hydra and Burp Suite are commonly used by attackers due to their capabilities to perform various types of ATO attacks. tCell protects your application by monitoring authentication events to identify and block ATO attacks. Additionally, tCell provides a list of compromised users, giving you the ability to quickly remediate.

What is it?

An ATO attack consists of a malicious actor gaining temporary or persistent access to a user’s account. There are two common types of ATO attacks: session hijacking and password attacks. A session hijacking attack occurs when a user’s application authorization tokens stored in cookies are stolen via other attack vectors, such as XSS or SQL Injection. This token is then used to gain temporary access the user’s account and perform any actions as that user. Password attacks use techniques such as character enumeration (brute-force), using dictionary words (dictionary) and lists of previously stolen credentials (credential stuffing) to gain access to a user’s account. Some of the security best practices to protect your application is to use two factor authentication and rate limiting. OWASP’s Blocking Brute Force Attacks and OWASP’s Credential Stuffing Prevention Cheat Sheet are both great resources to learn more about preventing ATO attacks.

How do malicious actors find vulnerabilities?

Most commonly, a malicious actor would use tools such as THC-Hydra and Burp Suite to perform ATO attacks. Both tools have functionality allowing them to perform credential stuffing, dictionary, and brute-force attacks.

How do I use tCell to protect my application?

tCell can detect account takeover attacks by instrumenting the application's authentication framework. It natively supports the following frameworks:

Java

• Spring Security 5.0.x
• Spring Security 4.0.x

Ruby

• Devise
• Authlogic

Python

• Django Auth

Node

Passport (express)

We recommend using a supported authentication framework. If you do not use a supported framework, use the hooks package.

tCell allows for use of API hooks in order to receive authentication data from frameworks that are not natively supported. Please see the Development pages in the left navigation pane for detailed instrumentation instructions.

Interface

Account takeover is enabled by default in the console. To verify, in your tCell console go to Policies -> Account Takeover and ensure that all of the checkboxes on the page are checked. tCell monitors the following data points:

• Authentication failure rates
• Authentication attempt rates
• Page view patterns post authentication
• Session tokens

This data is streamed into tCell’s cloud service, which analyzes authentication histories over windows of time ranging from 10 minutes to 30 days. The data is augmented with additional information such as:

• IP reputation
• Geo location
• ASN

tCell’s analytics engine then identifies attacks, including bot attacks, both distributed and individual, short lived and long running.

It will also provide you a list of compromised user accounts so you can quickly remediate. If a user’s account is compromised via a session hijacking attack, you should invalidate their session token. If the user’s account password is compromised, you should have the user change their password and disallow account access until that has been completed. tCell's analytics engine can identify attackers that can then be automatically blocked. This is done using tCell’s Suspicious Actors feature. To enable blocking, go to Policies -> Suspicious Actors and ensure that Automatic blocking of Suspicious Actors is set to either Block Suspicious Requests or Block All Traffic.

Ongoing password failures