Stop Account Takeovers (ATO) on Online Gaming Accounts with Arkose Protect™

Hit rate

The number of valid sets of credentials that can be harvested from a credential stuffing attack is called hit rate. For bulk accounts, the hit rate is around 5% whereas for premium gaming accounts it is 0.0075%. The hit rate is lower for gaming accounts, since the majority of players are young users and the chances of their credentials being breached from other websites is much lower. Therefore, for an average quality combo list with 1 million credentials, attackers can harvest around 50,000 bulk accounts and 75 premium accounts.

Reputation of the attacker

Bad actors take advantage of the marketplace on the dark web to sell off the harvested credentials. A seller’s reputation plays a big role in determining how much of their inventory they can sell. New sellers, or those with a low reputation, can expect to sell up to 20% of their inventories. Experienced resellers, or those with a medium reputation, may sell up to 40% of their inventory, whereas long-term proven resellers with a good reputation may sell at least 60% of their inventory.

Market value of the compromised accounts

The market price of a user’s credential varies by industry. For bulk gaming accounts, the average revenue per credential is $1.70 which can amount to $51,000 for an attacker with good reputation, $34,000 and $17,000 for attackers with medium and low reputations, respectively. Similarly, for premium gaming accounts, the average revenue per credential is around $648, which can fetch $29,160 for a reseller of good reputation, $19,440 for medium reputation, and $9,720 for low reputation.

A website’s level of protection

Less-protected or unprotected websites are easy targets for attackers; they don’t need to have superior technical skills, and they don't need to create an attack infrastructure. On the other hand, highly protected websites may block or challenge close to 100% of the attack traffic, increasing the need for the attacker to resubmit requests, extending the timeline to completion, and raising the cost of the attack. Less-patient or skilled attackers are likely to give up an attack before it completes and move on to an easier target.

The traffic is spread through a large number of nodes, seeing a botnet consisting of over 10,000 nodes spanning several continents is common;

The traffic looks like it is coming from residential and mobile ISP, since traffic coming from data centers is generally considered more suspicious;

The attack traffic mimics the legitimate traffic as much as possible. For example, if users are expected to follow a specific path before reaching a resource, such as first visiting the site’s home page, then accessing the login page, and eventually logging in, the attack traffic must follow a similar workflow;

The expected data is sent with some variety in the fingerprint, yet guaranteeing that the fingerprint is valid to avoid being detected. This is because bot or fraud detection products typically collect a fingerprint client-side consisting of device and browser characteristics and user preferences, which is then evaluated to differentiate bots from humans or uniquely identify devices.

Failed attempts are resubmitted as a large majority of the attack traffic will be successfully detected and blocked or challenged. This increases the time to complete the attack.