In the world of cybersecurity, the term brute force attack and credential stuffing attack have been used interchangeably, leading to the confusion between the two terms. In fact, they are not similar to each other, although we can say that credential stuffing is a subtype of brute force attack (but not the other way around).
To be clear, here we will discuss the differences between the two cybersecurity threats, and what you should know to defend against them.
Summary: Brute Force Attack VS Credential Stuffing Attack
Brute force attacks refer to how an attacker attempts to guess a credential (typically username-password combination) of an account/system by trying every single possible combination. While there are various techniques that can be utilized, the principle remains the same: if it’s a 4-digit PIN, the attacker might try 0000, then 0001, then 0002, and so on until it reaches 9999.
Credential stuffing attacks are technically a type of brute force attack where the attacker already possessed an obtained credential (i.e. from a data breach) on another website. For example, the attacker might possess a password-username pair of a Gmail account, and then tries the same credential on Facebook. The purpose here is to find credentials that are used on multiple sites.
What Is a Brute Force Attack?
A brute force attack is, in a nutshell, a trial-and-error attempt to crack the username and password of accounts or systems. Since there can be thousands and even millions of possible combinations, today’s brute force attacks are often done by using automated bots to attempt as many guesses in as little time as possible.
Brute force attack is among the oldest tricks in a book and has been around since the earliest days of the internet. However, why it remains popular is fairly obvious: given an unlimited amount of attempts and an infinite amount of time, it will always succeed.
This will also mean that there isn’t a single, perfect way to defend against brute force attacks, and we can only prevent and mitigate its effect.
Although it’s called brute force, this isn’t saying there is no intelligence behind today’s brute force attack methods, as they do involve pretty sophisticated logic at times, for example:
- Dictionary attack: using a list/dictionary of commonly-used passwords to guess the password more systematically
- Hybrid attack: combining a dictionary attack with the standard, permutation-based brute force attack to improve its success
- Reverse brute force: instead of guessing different passwords against a username, this technique uses 1 commonly-used password against a lot of different usernames
What Is a Credential Stuffing Attack?
Credential stuffing attacks, as discussed, are typically considered as a subset of brute force attacks. However, a credential stuffing attack is rather special due to the fact that it relies on already-possessed/compromised credentials to perform the attack.
Typically the compromised credentials are obtained from a data breach, which is often sold on the dark web and black market. The attacker will then attempt to use these credentials on other sites.
The basic principle behind credential stuffing is pretty simple: it exploits the fact that so many of us use the same pair of username and passwords on different accounts. In such cases, when one of our accounts is compromised, all of our accounts are now vulnerable unless we change our password immediately. The thing is, many people didn’t realize that their credentials have been compromised until it’s too late.
This is why the basic approach in protecting yourself from a credential stuffing attack is to use unique passwords for all of your accounts, a thing that is very easy to do but is often overlooked.
Credential Stuffing VS Brute Force: Comparison
Here are the key differences between the two cybersecurity threats:
| Credential Stuffing | Differences | Brute Force Attack |
| Using stolen credentials to attempt login on other sites. Relies on the fact that users tend to reuse the same passwords for different accounts | Method | Trying all possible combinations to find the right password-username pairs. Assumes the user’s passwords are weak. |
| Utilizes advanced technologies like | Technology | Typically relies on raw computing power. Might involve logic but typically only require simple automation. |
| Can target a lot of (thousands) accounts simultaneously across many different websites | Scope | Typically target only a handful or account on one platform at a time, might even only target one account |
| Fast (either it succeeds or it doesn’t), harder to detect than traditional brute force attacks | Nature | Tend to be more obvious and overall slower |
How To Detect and Prevent Brute Force and Credential Stuffing Attacks
Typically both credential stuffing and brute force attacks utilize the use of bots or automated software to perform the attack. So, the main approach in preventing these attacks is to detect the presence of bad bod activities on your site by:
- Investing in bot mitigation and advanced account takeover prevention software like DataDome that will detect the presence of bot traffic in real-time and block malicious bots automatically
- Regularly monitor your traffic (both manually and with the help of various traffic analytic solutions) and check for changes in traffic like multiple login attempts within a short amount of time
- Especially monitor your login failure rate. In a credential stuffing attack, the success rate can be as low as below 0.1%.
- Check for unusual increases in site traffic and an unusual spike in bounce rate
- CAPTCHA can be a basic defense against bot activities, but the presence of CAPTCHA farms has significantly reduced its effectiveness in recent years. Use CAPTCHA as a preventive screening method, and not as a one-size-fits-all solution.
End Words
As we’ve discussed, while credential stuffing attacks can be categorized as a subtype of brute force attacks, there are some major differences between the two, which might affect how we can detect and prevent them.
While there is, at the moment, no perfect method that can 100% protect your network from credential stuffing and brute force attacks, investing in an advanced account takeover protection solution that can effectively detect and block malicious bot activities is the best approach in protecting your site from brute force and credential stuffing attacks.
