Account Takeover

Account takeover (ATO) is becoming an increasingly popular type of illegal activity. Anyone who uses the Internet can become its victim. As a result, their reputation might get tarnished. They might lose their funds or access to valuable data. In this article, we’ll explain what ATO is and how to protect yourself from it. This information can come in equally handy for businesses and private individuals — but the former should be able to benefit more from it.

Essence of ATO

When a third party takes over your account, it means they enter your account as if it were you. They might leverage various techniques for that. Then, they can use your account at their discretion — for instance, send your funds to someone if we’re talking about a bank account. Or, they might change the login and password for the cloud where you store your photos and videos. There are ways to make such actions look natural. Neither you nor the company whose services you access online won’t be suspicious of anything.

Let’s have a look at a real-life example. In 2020, several A-list celebrities, including Bill Gates, Kanye West, and Barack Obama, posted tweets promoting Bitcoin. They encouraged people to transfer to them any amount of the pioneering cryptocurrency — and promised to send back twice as much to each user. Unfortunately, that was a scam. Over 100 accounts were involved in it as a result of an ATO.

The Twitter management was shocked and came up with an ambiguous solution. They temporarily prevented the involved influencers from posting anything at all. Users didn’t quite appreciate that awkward move and their trust in the social network was largely undermined.

Role of Automation

To enter someone else’s account, an unscrupulous individual might try to hack it with their own hands. However, it would require time, effort, and technical expertise. Besides, such hacking attacks tend to be easy to detect. That’s why criminals prefer to buy the credentials of third parties on the black market. Normally, they do it in bulk and purchase the logins and passwords of hundreds of accounts in one go.

Then, they decide which web resources to target and what to do after they enter the accounts. To automate these tasks, they resort to bots because the latter work much faster than humans. They try to break into the accounts by leveraging the credential stuffing technique. This means they try the stolen login-password combinations one by one at a very high speed until some combination lets them access the account. Then, hackers can steal anything they wish from the account — such as personal data or loyalty points.

Apart from the credential stuffing term, you can also come across its credential cracking counterpart. Both are identical from the technical point of view. The difference lies in the scope of targets. With stuffing, the scope of potential victims is very wide. It can include any individual or organization whose details were mentioned in the database that the hacker bought or stole. With cracking, the attacker purposefully strives to access specific accounts — for instance, of top managers of the selected company.

Here are the three most typical gateways for the malicious bots:

• Login
• Card
• Payment

They are equally vulnerable on APIs, mobile apps, and websites. If something about these gateways seems suspicious to you, don’t hesitate to double-check the probability of hacking. Please mind that this short list is not exhaustive and malicious actors can target many other points too.

When bots attack a website, API, or mobile app, they don’t only put user accounts at risk. They also create an overwhelming load on the site, API, or app, so that the latter might stop functioning properly for a while. That’s why their owners should invest funds and hire skilled experts to prevent attacks. Otherwise, they might face financial losses and lose some part of their audience.

Increasing Sophistication

Every year, hackers are becoming more and more discerning. The solutions that used to be efficient against them three years ago might be useless today.

The scale of attacks can be impressive. It’s not uncommon for hackers to send millions of requests to the target website daily. To disguise their actions, they can make bots use hundreds of thousands of IP addresses from all countries on the globe. Advanced bots convincingly imitate organic human behavior, so it’s challenging to tell them from regular users.

At the same time, the frequency of ATO attempts has been skyrocketing. During the pandemic, people got used to buying things online, having fun on the Internet instead of going out, and benefitting from virtual analogs of conventional services, such as telemedicine. Hackers see many more potential victims now and feel motivated to evolve.

It’s not enough to implement a cybersecurity system once and forever. It’s vital to regularly update it. Plus, it’s crucial to have skilled professionals by your side who can consult you at any moment.

ATO Signals

The last thing hackers want is to get detected before they reach their goals. That’s why they try to act as discreetly as possible. The more time they have, the more funds and data they can steal. Here are the signals that might hint at the probability of an ATO:

• A person is trying to log in from a computer, laptop, tablet, or smartphone that they have never used before.
• The configurations of that device are suspicious — they differ from the ones that this person used to stick to. Or, they might be typical of the configurations that malicious actors prefer.
• They fail to log in on the first attempt but keep on trying.
• The version of their operating system and/or browser is old.
• When placing an order, they type in a new delivery address.
• Their buying behavior seems abnormal. For instance, they purchase products that they have never been interested in previously. Or, they order much larger amounts of products than usual.
• The number of closed accounts in the system is rapidly increasing.

To detect these signals, you’d better rely on automated solutions. They should keep analyzing user behavior non-stop and warn you about abnormalities.

Often, it’s not the business but the clients who detect ATOs. Some people immediately report the issue to the support crew. Others leave in silence.

Imagine an online AI image generator. A person used a virtual card to pay for its services and the sums of the payments were not too large. The person never revealed their full identity details to the service. If they find out that their account was hacked, they might delete that virtual card and switch to another similar service. That would take less effort than reaching out to the support department.

Meanwhile, if hackers take over an account in a payment system, the rightful owner will be more likely to fight for it.

Importance of ATO Prevention

To understand why it’s so important to prevent ATO, let’s have a look at the risks that this type of illegal activity can have on businesses and private individuals:

• The information that is valuable to you can be compromised. If you’re a private individual, it can be your passport or ID details, the numbers and codes of your bank cards, and so on. If you’re an employee or an entrepreneur, third parties can steal confidential data related to your professional activities. This might lead to financial losses, reputational damage, contract cancellation, and so on.
• Businesses can lose customers and the money that they bring. Some might think that it’s up to Internet users to protect themselves. However, according to statistics, at least one-half of all the online audience neglects the most basic security rule. They use the same password for multiple websites and apps. Usually, it’s easy to remember this combination of letters and numbers — and crack it. Organizations can’t make consumers change their habits. However, they can do something on their side to prevent undesirable situations by implementing advanced security solutions. Clients expect businesses and government bodies to do so. If you as a business owner fail to protect your audience’s private details and a breach takes place, people might leave your company and never come back.
• Companies can lose funds by processing fraudulent transactions. Let’s imagine that a hacker gets hold of an online shop account, places an order, and pays for it using the stolen card credentials. The shop’s team thinks it’s a normal purchase and delivers the order to the hacker. The real customer goes to court and claims their money back. After that, the situation will develop according to the national (or maybe international) laws. The shop might need to transfer the full price of the purchase back to the rightful account owner. Plus, it might need to pay all the fees related to processing the financial transactions.
• There might be fines for companies that fail to meet their industry’s security standards. This, again, depends on the local legislation. Companies can try to get insured against data leaks. If they’re lucky, they might get compensation if hackers get hold of their clients’ data. It’s also possible that they get a fine for violating the security norms and benefit from an insurance indemnity for the same case.
• Elimination of ATO consequences can take months. First, consumers might start bombarding your support crew with complaints. Your PR and marketing team will need to go to great lengths to motivate people to buy from you again. Your sales department might need to reinvent its strategy. Your IT team might end up being fired and your HRs will need to hire a new one instead. Most of your employees will have to forget about their day-to-day duties for a while to overcome the emergency. Your growth and development will slow down.

Sounds a bit scary, right? That’s why it’s always wiser to take preventive measures.

Ways to Prevent ATO

Here are the three tried and tested ways to prevent ATO.

Invent Strong Passwords and Enable Multi-Factor Authentication

This recommendation might seem obvious. However, as said above, too many users neglect it. It’s not necessary to invent each password separately and manually put it down in safe storage. Modern browsers, such as Google Chrome, can suggest strong passwords to you and save them securely. It will be up to you whether to enable autocompletion or not for each website and app individually. Please mind that there should be a dedicated password for each service that you use. Avoid copying and pasting the same string of characters for each page you log in to.

Multi-factor authentication (MFA) suggests it’s not enough to type in the password to sign in. There will be a second stage of verifying your identity — such as introducing the code from an SMS or showing your face to the camera in real time. Thanks to such an approach, hackers who buy databases with stolen account credentials would fail to log in to your account. On the flip side, MFA adds friction to the process — it’s mandatory to make more clicks to access your account. Many people opt to avoid this obstacle, even if it means sacrificing security.

Notify Users About Changes in Their Accounts

This recommendation is valid for business owners. You can send notifications to your customers each time someone tries to modify the data in their profiles or places an order.

Selected services notify users each time they sign in to their accounts — but it’s a double-edged sword. Some people might find it irritating. Consider sending out warnings only when a person logs in from an unusual device and/or location.

Install Reliable ATO Prevention Software

The selection of the available products on the market is impressive, so you’ll be spoilt for choice. To avoid overpaying for excessive functionality, thoroughly analyze your needs before the purchase. Consult with cybersecurity experts.

Inefficient ATO Prevention Methods

The efficiency of an ATO prevention method depends on where and how you use it. One solution can work wonders for the sign-in page and be mediocre for the sign-up one. You should take into account the gateways that hackers can use in your particular case and the potential types of threats for each gateway.

Below, we’ll talk about the ATO prevention solutions that are not entirely useless — but are definitely not sufficient to ensure robust security guarantees.

CAPTCHAs

Years ago, CAPTCHAs were a safe bet against bots. Unfortunately, that’s no longer the case. Today, bots can cope with simple and old-school puzzles effortlessly. If you’re curious about how to create such bots, there are dozens of free tutorials on YouTube. It hardly makes sense to invent more elaborate CAPTCHAs because human workers will be ready to solve them in exchange for a small reward. Bot creators hire individuals from developing countries for this mission, and this is called CAPTCHA farms.

Regular human users are not too happy with CAPTCHAs either. First, they perceive it as an irritating intervention. Second, people might fail to solve the most difficult puzzles and end up being blocked on the platform. They might feel upset or even furious. The business might lose a potential customer who was willing to spend money and didn’t have the slightest intention of violating the rules.

We don’t mean to say that CAPTCHAs need to be entirely abandoned. To make the most of them, it’s advisable to combine them with an ATO prevention system.

Web Application Firewalls

Web application firewalls (WAFs) can be efficient against selected varieties of threats, such as session hijacking or cross-site scripting. However, they struggle to identify attacking bots because the latter are automated and operate in real time. Here is what a modern bot does after opening a web page: spends a few seconds on it without doing anything, pretends to explore the content, makes a click, waits again for a few seconds… Judging by such behavior, a WAF believes it’s a human visitor.

The biggest issue with WAFs is that they rely on IP-based rules. Meanwhile, bots are capable of juggling multiple IPs to trick the firewalls.

Outdated MFA Channels

As said above, multi-factor authentication can be a lifesaver — but only when used appropriately. Hackers can intercept or redirect SMS messages that the company sends to its users. The good news is that most cybercriminals are too lazy to do it. They’re well aware of a huge number of easy victims and prefer to target them with minimal effort.

Instead of SMS confirmations, it would be wiser to employ dedicated apps, such as Authy or Google Authenticator. They’re user-friendly and provide substantial security guarantees.

Reaction to ATO

Now, let’s have a look at the worst scenario. Imagine that your business is experiencing an ATO attack right now. This is what you should do:

1. Get in touch with your cybersecurity team immediately. They should have a ready-to-use plan of action. Probably, they will need to fine-tune the plan to the actual circumstances. However, the fine-tuning can be done on the go, while the initial measures are already taking place.

2. Try to slow down the most primitive bots with the help of your web application firewall and rate limiting capabilities. It’s a simple step that might fail to entirely block the attack. Nevertheless, it would be great if you manage to combat at least some part of the perpetrators.

3. Temporarily disable the opportunity to change user data. Thanks to this measure, hackers won’t be able to set up new passwords for the stolen accounts. The original owners of the accounts will be able to access them as usual.

Act promptly and decisively. Deprive hackers of time and opportunities.

Final Thoughts

Account takeovers (ATO) are becoming more and more common. If you become a victim, it might take you a lot of time and effort to overcome the consequences. Instead, it would be more reasonable to prevent such threats. Invest in modern and powerful ATO protection software — every cent that you’ll spend on it will pay off very soon.

Don't wait until your business falls victim to cybercriminals, causing you to lose money and customers. Take a proactive step today by utilizing the advanced capabilities of BotBye. Start using the free trial of BotBye today and see for yourself the reliability of bot protection. We ensure the best security for your business. Click here to create an account and effectively protect your online assets.