Protect eCommerce Websites From Account Takeovers With Arkose Protect™

The hit rate

This metric defines how many valid sets of credentials will be harvested from the credential stuffing attack. The ratio may vary depending on the industry and the quality of the combo list used. A combo list is a collection of known username and password combinations. For eCommerce websites, the estimated hit rate is about 15% because the usage of an email address as a user ID is quite common. Combo lists with email addresses and passwords are also a lot easier to find. Assuming an average quality combo list with 1 million credentials and a hit rate of 15%, the estimated total number of credentials harvested from a credential stuffing attack on an eCommerce website is 150,000 credentials.

The attacker's reputation

Attackers take advantage of the dark web to sell the credential they harvested through their credential stuffing attacks. A seller’s reputation directly affects how much of their inventory will be acquired. Sellers new in the business with no/low reputation may sell up to 20% of their inventories, whereas more experienced resellers with a medium reputation may sell up to 40% of their inventory. Long-term proven resellers with a very good reputation may sell at least 60% of their inventory.

Account market price

The market price of a user’s credential varies by industry. The average revenue per credential for the commerce sector for an attacker with a good reputation is about $7,200, $4,800 for an attacker with medium reputation and $2,400 for an attacker with low reputation.

A website’s level of protection

The infrastructure needed for a successful attack varies based on the protection a company has in place. The Economics of Account Takeover Attacks reveals that certain sophisticated security solutions can increase the attackers’ cost and significantly erode the revenue potential. That said, expert fraudsters with excellent reputations on the dark web will still be able to make a decent revenue.

When attacking a well-protected site, the number of replays, the lack of fast progress, the complexity of the attack strategy, the rising cost, and the uncertainty of how long the attack will take to complete may unnerve less experienced attackers and convince them to give up early, significantly affecting their inventory and ultimately their net income.

The traffic is spread through a large number of nodes, seeing a botnet consisting of over 10,000 nodes spanning several continents is common;

The traffic looks like it is coming from residential and mobile ISP, since traffic coming from data centers is generally considered more suspicious;

The attack traffic mimics the legitimate traffic as much as possible. For example, if users are expected to follow a specific path before reaching a resource, such as first visiting the site’s home page, then accessing the login page, and eventually logging in, the attack traffic must follow a similar workflow;

The expected data is sent with some variety in the fingerprint, yet guaranteeing that the fingerprint is valid to avoid being detected. This is because bot or fraud detection products typically collect a fingerprint client-side consisting of device and browser characteristics and user preferences, which is then evaluated to differentiate bots from humans or uniquely identify devices.

Failed attempts are resubmitted as a large majority of the attack traffic will be successfully detected and blocked or challenged. This increases the time to complete the attack.