We see these kinds of attempts with some frequency. Normally a leak has happened from some other 3rd party, and an attacker has a big list of known account + password combinations that they can try against other systems. They then hit our system (in this case, a website login form) testing all the credentials they have for a match.
Given that people are unreliable at using unique credentials, and that not everyone on our platform has opted in to using 2FA (and we don't want to force it), are there additional steps we can be taking to help protect users, or efforts we can undertake to combat being used as a testing ground for leaked lists?
(It's also very annoying having to scale up large numbers of instances because some attacker is throwing vast numbers of concurrent attempts per second at our infrastructure!)
Obvious precautions we already implement:
- Rate limiting attempts per account, combined with a temporary lockout, but that doesn't help against a list of single entries.
- Rate limiting attempts per IP address, but that doesn't stop when the testing is distributed over a large number of nodes. Typically we see enumerations happening from 5k+ addresses, and that means at least 25k accounts can be tested before we start filtering those addresses.
We are evaluating the idea of using email confirmations as 2FA (for users not opt-ed in to using a 2FA device with us), when we see a login from a device we don't know, but we will first need to measure the customer impact.
Can (and should) we be undertaking further efforts to protect users?
