Credential stuffing & review bombing - the next generation cyber attack

Day after day, the cyber attack platform is going to be equipped by modern transformed technologies and automated systems. The capability of Machine learning and Artificial Intelligence system is making it even more powerful. In the next few years, artificial intelligence, machine learning and advanced software processes will enable cyber attacks to reach an unprecedented new scale, wreaking untold damage on companies, critical systems and individuals.

What this means is that we are on the verge of a new age in cybersecurity, where hackers will be able to unleash formidable new attacks using self driven software tools and processes. These automated attacks on their own will be able to find and breach even well-protected companies, and in vastly shorter time frames than human hackers. Automated attacks will also reproduce, multiply and spread in order to massively elevate the damage potential of any single breach. 

For years the hackers are developing better software methodologies and tools to crack a password and hack your account. 

One new innovation is an automated cyber attack called "credential stuffing," which uses previously stolen passwords to break into online accounts. This attack is extremely effective and dangerous, because so many people reuse their passwords across multiple accounts. This creates a major blindspot for businesses, because even if their security is up to par, all it takes is one sloppy employee, and the whole company can unravel.

Expect these attacks to increase significantly next year, especially since there is now a glut of stolen password databases for sale in the Dark Web. Hackers recently used credential stuffing to target Dunkin Donuts' DD Perks reward program. More businesses will fall victim to it in 2019.

However credential stuffing have no exact solution yet; researchers have discovered that machine learning programs can be used to predict the passwords a person will create in the future based on what he or she has used in the past. Think about that for a second. This means that if a person loses a couple of passwords to data breaches over the years, that person could, in theory at least will be forever vulnerable to password attacks in the future by malicious AI systems scanning the web. This could lead to continual password breaches, which will be very hard to stop.

Likely a few bad posts on the web can undermine a company’s reputation, and cybercriminals are realizing that this is a huge market opportunity for them. With bots, such "brand extortion" is extremely easy and cheap to accomplish. 

The recent attack on CheapAir, a flight price comparison website, is the perfect example - Cybercriminals threatened to launch an SEO attack on the company unless it paid them off. When CheapAir refused, the criminals followed through on their threat unleashing a torrent of negative reviews via bots. 

"Review bombing" by bots will gain momentum next year and into the future, since this capability already exists and the attack is easy to carry out. Hackers have been extorting businesses for many years with denial-of-service and ransomware, so brand extortion is a logical next step.

A review bomb on the other hand is an act of aggression, a step meant to send a message of extreme discontent with the actions of a particular developer.

The majority of reviews were posted when the game or an application is launched, with a reasonable number of negative reviews posted at the same time. That makes sense, as Fire-watch isn’t a game for everyone. There are a number of review spikes throughout the life of the game or application, likely due to Steam sales. And then the review bomb pops up.

It’s hard to say without having access to sales information, but the negative reviews rarely have anything to do with the game or app itself. Sometimes they happen due to the actions of the developer, and other times they’re posted to draw attention to a particular problem in a game’s or app's update or some other unresolved issue.

In other words, review bombs take place not to talk about the quality of the game or app in any kind of general sense, and they are rarely posted to give any information about whether or not they should buy the game or app itself. The most popular use of review bombs is to send a message about one particular issue or perceived wrongdoing on the part of the developer or publisher.

They do bring attention, both good and bad, to the issue that’s angering those who are posting the negative reviews. These bombs are talked about, which means the actions that the bombs are meant to protest get more publicity. They are successful if judged only by the attention they gather, which means they are likely to continue unless Steam takes other measures to limit their efficacy.

We can debate the “proper” use of customer reviews, but their utility for sending this kind of message is hard to argue. It has been interesting, anecdotally, to hear so many players defend review bombs due to the fact that they feel like there is no other way to get the attention of a developer.

They may hurt sales, or they may make the mob seem sinister, but they do gather that one resource very well. They do get your attention!