Fractal Security

As mentioned last week, Fractal Threat Recon picked up a sharp rise in credential stuffing attacks on the world's largest ticketing/event platform, Ticketmaster. This week bad actors added new listings that included specific artists on breached accounts, this included high-value artists such as Taylor Swift, Billie Eilish, and Olivia Rodrigo. With this information, we conducted our test to validate the vendor's claims and notify the account holder of the breach. We purchased account credentials claiming tickets to an upcoming Taylor Swift concert for $7.50. Sure enough, the account had two Taylor Swift tickets worth well over $4000. Bad actors will transfer these tickets to a burner account and sell them for profit for a quick 500x ROI. We reached out to alert the account holder and discovered that she had received them as a graduation gift and would have been devastated if she no longer had them. Account security is an ever-changing landscape. Organizations require new solutions to defend against attackers and protect their customers. The 3 core things Fractal does to boost customer account defense are: 1. Awareness: Fractal provides insights across 1,500+ dark web communities to find the exact vulnerabilities and exploits attackers use to commit fraud and attack your organization on average 4 months faster. 2. Management: Fractal alerts your organization and does the work to analyze and uncover the problem. Most importantly, we work with your team to develop a timely, effective patch/solution 24-72 hours after detection. 3. Defense: Fractal Bot Defense utilizes groundbreaking obfuscation to prevent the use of solver services and the most sophisticated attackers, further securing customer accounts and preventing credential stuffing attacks. Ticketmaster isn't the only organization suffering from credential stuffing attacks. See if your organization is under threat: https://lnkd.in/gQtqZWpg

Over the weekend Fractal saw a sharp rise in credential-stuffing attacks on one of the largest ticketing platforms. Previously, we saw bad actors renting out solver services to bypass the protections in place. This allowed them to attack the platform successfully, though the attacks were slower and more expensive. We identified the sharp rise was from a new exploit used by bad actors to bypass all current anti-bot solutions; this is allowing them to attack at faster rates and without the need for solver services, making attacks much cheaper and more effective. Once the accounts have been breached, the payment method, age of the account, and most importantly, any active tickets are captured and sorted. Last night we saw a bad buyer transfer Taylor Swift concert tickets from a breached account to their own, and sell it on another platform for thousands of dollars. With a high value on each account and a low barrier to entry, bad actors have massive motivation to utilize this exploit and can easily steal hundreds of thousands of accounts in a matter of hours. Here is how Fractal helps handle this type of incident: ?Fractal Threat Recon was able to detect and identify the exploit before bad actors began utilizing it to attack, giving the platform time to rapidly deploy a fix. ?Fractal Bot Defense utilizes groundbreaking obfuscation to prevent the use of solver services, further securing customer accounts and preventing credential stuffing attacks. Usually, exploits like this go undetected for months, leading to massive amounts of fraud, exposure, and damage. I’ll post an update in a few weeks to see if attacks have slowed or increased. See if your organization is under threat from automated threats with: https://lnkd.in/gQtqZWpg

We recently detected a critical 2FA vulnurability in a large food delivery service. Bad actors found an exploit that allowed them to change the email on file without performing 2FA. For obvious reasons, this alone is bad. But when paired with the fact that this company also doesn't have adequate bot protection, it gets event worse. Without adequate protection, bad actors were able to deploy bots that used this exploit in combination with solver services at scale to steal hundreds of thousands of accounts in a matter of hours. Pictured below is a (now sold) bulk listing for 79k accounts with payment methods attached. Here is how we would have handled this incident: 1. Fractal Threat Recon was able to detect this before it was exploited and could have been used to rapidly deploy a fix. 2. Fractal Bot Manager would have prevented the use of solver services which allowed the exploit to be used at scale. Unfortunately this is not an isolated incident and this company has been dealing with credential stuffing + 2FA exploits for a while now. Our new Threat Recon Preview gives them a D currently (also pictured below) You can check that out yourself @ https://lnkd.in/g5B2fhMD

We recently detected a critical 2FA vulnurability in a large food delivery service. Bad actors found an exploit that allowed them to change the email on file without performing 2FA. For obvious reasons, this alone is bad. But when paired with the fact that this company also doesn't have adequate bot protection, it gets event worse. Without adequate protection, bad actors were able to deploy bots that used this exploit in combination with solver services at scale to steal hundreds of thousands of accounts in a matter of hours. Pictured below is a (now sold) bulk listing for 79k accounts with payment methods attached. Here is how we would have handled this incident: 1. Fractal Threat Recon was able to detect this before it was exploited and could have been used to rapidly deploy a fix. 2. Fractal Bot Manager would have prevented the use of solver services which allowed the exploit to be used at scale. Unfortunately this is not an isolated incident and this company has been dealing with credential stuffing + 2FA exploits for a while now. Our new Threat Recon Preview gives them a D currently (also pictured below) You can check that out yourself @ https://lnkd.in/g5B2fhMD

Fractal Security is looking for design partners to provide feedback and help shape our solutions. What we are offering: - Advanced, invisible, easy to add bot defense solution. - FCFS release protection for e-commerce product launches. - Your companies fraud exposure timeline due to account takeover. - Audit of your current bot protection vendors and their attacker deterrence. - Exploits on your site and applications bad actors use to attack and/or facilitate fraud with remedy recommendations. Interested in becoming a design partner? Contact us: https://lnkd.in/gPvSZTvA