Crooks are unlikely to know which consumers have been sloppy with their passwords, much less which higher value accounts these login credentials might unlock. Sentry MBA gets around this problem by creating a means to launch brute force attacks.
Any long list of stolen credentials will almost certainly include many that open accounts on the sites coveted by hackers. Sentry MBA automates the process of testing millions, or tens of millions, of compromised username/password combinations to see which ones work - a task that would be impossibly time-consuming without automation.
how to crack accounts with sentry mba
Sentry MBA is a potential menace to any site with valuable data behind its login page. In some cases gamers use the tool to crack into accounts on online gaming websites. Tutorials and YouTube videos (example below) on how to use Sentry MBA are easy to find online.
In one cracking community, a user commented that OpenBullet is better than Sentry MBA and SNIPR because their configuration files are outdated, and that few make configuration files for these tools anymore. While configs for Sentry MBA, SNIPR, and other well-known tools can still be found within cracking communities, there is a new and noticeable trend for OpenBullet configs as well. OpenBullet configs for services such as Netflix, Microsoft Azure, IMVU, Scribd and other services are for sale on cracking forums.
Like Sentry MBA and other tools, custom configs and URL inputs can be found being traded and sold within cracking communities for the purpose of account cracking. Common targets for Private Keeper seem to include popular online video games and streaming services.
These tools are coded using a multitude of different tools, or may include mods to existing tools. They are frequently seen for sale or trade on popular dark markets or within online cracking communities.
The 29-year-old, together with Daniel Thompson, Idris Kayode Akinwunmi, and others schemed over ways to make quick cash from the lottery and Batson suggested the use of Sentry MBA to crack and access user accounts.
Sentry MBA is an automated cracking tool that is widely available online. The software suite can be used in credential stuffing attacks when there is a lack of anti-automation protections, taking the need to have any technical knowledge out of the equation to slam an online service with lists of weak password and user combinations, as well as compromised account combinations leaked through data dumps and paste websites.
Cracking and Credential Stuffing tools have made ATO attacks extremely easy for even low-tech criminals to profit from automated attacks against any website of choice with little more than a few mouse clicks. This new and emerging attack vector means unsophisticated actors can compromise your customer accounts with little to no knowledge of traditional hacking techniques.
The existence of this type of functionality does indicate the cracking community is aware that Javascript-based checking like this is a challenge, and they are starting to work on ways to defeat it, with some success as shown in the case of STORM.
Then when they have verified the accounts work they can manually access them via the web interface and exploit them. As more companies attempt to lessen these attack vectors there will inevitably be pressure to defeat and bypass corporate bot detection systems in these cracking tools.
Private Keeper is a tool used across Russian-language cybercriminal platforms, developed by a threat actor who goes by deival909. Initially created as a brute-force cracking tool, the software underwent several changes during its development, enabling users to create and configure their own brute-force crackers and utilities with the help of in-line technology. Private Keeper contains a utility for collecting private proxies from other private services and provides access to multiple finished projects in an application store. Online tutorials explain how to use Private Keeper to target specific victims, such as banks and other financial organizations.
It is made possible because of the tendency for users to recycle their passwords for multiple accounts. This means that if criminals can crack stolen passwords from one account, they have legitimate credentials that have quite likely been used on other accounts.
The result is an attack methodology that is easy and effective, and can be operated by any person with just the merest of technical skills. It involves just five steps: obtain the stolen credentials; choose a target; create an automation script to recognize whether the login attempt succeeds or fails; use a configurable credential stuffing tool such as Sentry MBA that can bypass controls such as WAF and CAPTCHA; takeover accounts and steal assets.
Credential stuffing attacks are possible because many users reuse the same username/password combination across multiple sites, with one survey reporting that 81% of users have reused a password across two or more sites and 25% of users use the same passwords across a majority of their accounts.[4] In 2017, the FTC issued an advisory suggesting specific actions companies needed to take against credential stuffing, such as insisting on secure passwords and guarding against attacks.[5] According to former Google click fraud czar Shuman Ghosemajumder, credential stuffing attacks have up to a 2% login success rate, meaning that one million stolen credentials can take over 20,000 accounts.[6] Wired Magazine described the best way to protect against credential stuffing is to use unique passwords on accounts, such as those generated automatically by a password manager, enable two-factor authentication, and to have companies detect and stop credential stuffing attacks.[7] 2ff7e9595c
Comments