Account Takeover.

What is account takeover?

Account takeover is when an attacker gains control of an account that belongs to someone else. The account can be an email account, a bank login, a work account or any other online login. The attacker then acts as the real owner.

It is also called ATO or account hijacking. Here it means the security sense only. It does not mean a company taking over another company’s accounts in a business deal.

How does account takeover work?

The attacker first needs a way to sign in. Often that means a real username and password. MITRE ATT&CK describes this as the Valid Accounts technique, T1078. MITRE says adversaries obtain and misuse existing account credentials to bypass access controls. It lists four uses of such accounts: initial access, persistence, privilege escalation and defense evasion.

MITRE says the credentials can belong to local, domain, cloud or default accounts. It also says adversaries may target inactive accounts to avoid detection.

What does a typical attack look like?

OWASP describes credential stuffing as the automated injection of stolen username and password pairs into website login forms, in order to fraudulently gain access to user accounts. It relies on people reusing passwords across several sites. OWASP calls credential stuffing one of the most common techniques used to take over user accounts.

OWASP also lists what can follow once an account is taken over. Examples include draining the account, accessing sensitive information and sending fraudulent messages.

A simple illustration: if one account is taken over, the attacker may be able to reach other accounts linked to it. CISA gives an example where scammers who got into an email account then reached linked accounts. They reached banking and retail apps, made unauthorized purchases and changed passwords on several platforms.

How can you reduce the risk?

CISA explains that multi-factor authentication (MFA) asks you to confirm your identity when you sign in, for example with a code sent by text or email, or one made by an authenticator app. CISA says that even if an unauthorized user steals your password, they will not be able to meet the second step. CISA recommends turning MFA on for every account that offers it.

OWASP names multi-factor authentication as a primary counter-measure against credential stuffing. MITRE lists these mitigations for Valid Accounts:

• Multi-factor authentication.
• Password policies that change default passwords and reduce credential reuse.
• Privileged account management, which audits accounts and permission levels.
• User account management, which regularly audits and deactivates unused accounts.
• Account use policies, which can block logins from non-compliant devices or outside set IP ranges.

How does it relate to nearby terms?

Credential theft is the stealing of login details. Account takeover is what can happen when someone uses them. A brute-force attack is a way of guessing passwords by trying many of them. Multi-factor authentication is a defense listed by CISA, OWASP and MITRE. See the related terms for each.

Is account takeover the same as credential theft?

No. Credential theft is about getting the login details. Account takeover is about using an account that is not yours. A takeover often starts with stolen credentials, but the two terms describe different steps.

Is account takeover the same as account hijacking?

Yes, in everyday security use. Both terms describe an attacker taking control of an account that belongs to someone else.

Does multi-factor authentication stop account takeover?

It can make it harder. CISA says a stolen password alone is not enough to pass the second step. No single control covers every case, so the MITRE list above includes several mitigations.