Credential stuffing is an automated cyberattack where attackers use lists of exposed usernames and passwords, typically sourced from data breaches, to attempt to log in to other unrelated services. The attack's effectiveness hinges on the common user habit of reusing the same credentials across multiple online accounts. The scenario describes an attacker using a "list of commonly used access credentials," which is the defining characteristic of a credential stuffing attack against an online account. This method differs from a dictionary attack, which targets a single account with many passwords.

A. Phishing: This attack deceives users into voluntarily disclosing their credentials, rather than using a pre-existing list to force access.

B. Dictionary attack: This method attempts to guess a password for a single known username by trying words from a list (a dictionary).

D. Social engineering: This is a broad category of attacks that manipulate people; the described attack is automated, not based on direct human manipulation.

1. Open Web Application Security Project (OWASP). OWASP Automated Threats to Web Applications - OAT-008 Credential Stuffing. OWASP Foundation. Retrieved from https://owasp.org/www-project-automated-threats-to-web-applications/assets/oats/EN/OAT-008CredentialStuffing.html.

Reference Point: The "Description/Summary" section defines credential stuffing as "mass login attempts against a target web application using lists of usernames and passwords (credentials) that have been stolen from other web sites."

2. National Institute of Standards and Technology (NIST). NIST Special Publication 800-63B

Digital Identity Guidelines: Authentication and Lifecycle Management. June 2017.

Reference Point: Section 5.1.1.2

Paragraph 10

states: "Verifiers SHOULD check submitted passwords against a list of commonly-used

expected

or compromised passwords." This acknowledges the threat posed by compromised credentials used in attacks like credential stuffing.

3. Carnegie Mellon University

Software Engineering Institute (SEI). Defining Credential Stuffing. CERT Division Blog

April 2

2019.

Reference Point: The article defines the attack: "Credential stuffing is the automated injection of breached username/password pairs into website login forms in order to fraudulently gain access to user accounts." It explicitly differentiates it from brute-force and dictionary attacks.