Password Reuse to Blame for Fifth of Account Takeovers

Email account takeover (ATO) assaults normally previous for around a week and result from employees reusing passwords throughout various web sites, according to new investigation from Barracuda Networks.

The security seller teamed up with researchers at UC Berkeley to examine the lifecycle of email ATO assaults, examining 159 compromised accounts throughout 111 organizations.

The research revealed that attacker dwell time for about a 3rd of accounts was much more than one 7 days, emphasizing the importance of checking and danger removing instruments to place suspicious habits put up-compromise.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Interestingly, in a fifth (20%) of conditions, compromised accounts showcased in at least one earlier password breach. This implies that attackers are exploiting credential reuse to hijack accounts, possibly by means of credential stuffing or equivalent automated strategies, even though phishing is even now a common way to get log-ins.

In the extensive the greater part (93%) of ATO incidents analyzed, the attacker did not use the account to ship out phishing email messages, probably concerned that this would enhance their chances of staying uncovered.

Barracuda speculated that rather, they could be utilizing the accounts to start conversation hijacking assaults, or that they experienced only carried out ATO in buy to offer the account to yet another cyber-prison.  

Supporting the next theory is the actuality that, in 31% of scenarios, accounts are compromised by a person actor and then utilised by a diverse player to mine for data, or monetized in one more way.

This once again emphasizes the value of swift intrusion detection and reaction, the report claimed.

A solitary actor compromised and utilized accounts in 51% of scenarios.

Attackers are most probable to use hijacked email accounts to go immediately after email-connected Place of work 365 programs (78%). Of the remaining 22% circumstances, the vast majority (17%) showcased attempts to obtain SharePoint for sensitive documents.