What are the differences between credential stuffing and password spraying?

Question

Wikipedia describes credential stuffing as

a type of cyberattack where stolen account credentials typically consisting of lists of usernames and/or email addresses and the corresponding passwords (often from a data breach) are used to gain unauthorized access to user accounts through large-scale automated login. Credential Stuffing attacks are made possible because many users will reuse the same password across many sites

Interestingly there doesn't appear to be Wikipedia article on password spraying. Double Octopus describes it as

Password spraying is an attack that that attempts to access a large number of accounts (usernames) with a few commonly used passwords. Password spraying is an attack that that attempts to access a large number of accounts (usernames) with a few commonly used passwords.

It seems that password spraying and credential stuffing are similar in the objectives and approach. It isn't clear as to the discrete difference between the terms. Are there any and if yes, what would these be?

Answer 1

• Credential stuffing - use a bunch of usernames and passwords which are known to be associated with them to try and access multiple sites
• Password spraying - use a list of usernames and some common passwords (which aren't known to have been used by someone with the usernames being sent) to try and gain access to a single site

The key difference is whether the password is known to be associated with the account or not, and whether the attack aims to get access to a single site, or to multiple sites.

Answer 2

• Credential Stuffing - is a type of attack that relies on users reusing the same password and username combination across different applications, where at least one application is compromised. For example: say StackExchange was compromised and my account and password where leaked. Then an attacker could search other social media sites for users with the name MeowCat and try the leaked password they gained from the compromised StackExchange site.
• Password Spraying - is a type of brute force "dictionary" attack that is primarily used on applications where accounts are locked out after a set number of incorrect login attempts. Password spraying uses known/unknown(guessed) usernames and tries a small amount of very common passwords so they do not get locked out. For example: If a program locks an account after 5 incorrect guesses, then if you incorrectly guess 5 times, there is no point in continuing to guess, as even if you get the correct password, you will not gain access. This is why a password spray will only attempt at maximum the 5 most common passwords (in this case) for any account and move on to another account (Although they typically will only use 4 and not use 5 as then the site might become suspicious if all of their users are locked out).

Answer 3

I think everyone has made it clear, I am just giving in the field practical examples.

credential stuffing

This kind of attack is started through acquired leaked account credentials from an exposed source (e.g. exposed by bad website, hacking, etc). Haved I been pwned has a huge db of exposed accounts for a researcher to download.

To initiate the attack, the attacker just uses a script to skim through those exposed user credentials and trying to use it against any social network or important services platform to gain access. For example, an attacker gets a list of leaked password of Website XYZ, where user "JoeTiger" is using password "Meow@1234@7890". The attacker then just uses this information to construct a series of account names with the user name e.g. joetiger@gmail.com, joetiger@yahoo.com, etc with the same password.

Then the attacker will use this generated user name (and the mentioned password) and try login to all potential web services account, e.g. Amazon, Gmail, Linkedin, Netflix, Quara, Quicken etc using the password "Meow@1234@7890" even though the user may not using those services.

Password Spraying

This kind of attack is using the most frequently used passwords against accounts 10,000 most common passwords. To launch the attack, the attacker simply acquires any active email address list (this can be bought from darknet/ hacking/ download from exposed systems), then they use a script that brute force/cycling through the password against all the account lists until it gains access.

Effectiveness Prominent web services like Amazon, Google, etc are imposing login limits, making brute force attack less likely to be carried out over such services. To prevent a immediate login limit blocking. These attacks are mostly carried out from infected machine, i.e. Botnet to spread the attack.

Answer 4

To put a different spin on why these two techniques are different:

• password spraying exploits poor choice of password

• password stuffing exploits password reuse