{"id":1800,"date":"2022-09-08T12:58:00","date_gmt":"2022-09-08T12:58:00","guid":{"rendered":"https:\/\/apimike.com\/?p=1800"},"modified":"2022-12-12T21:58:12","modified_gmt":"2022-12-12T21:58:12","slug":"account-take-over","status":"publish","type":"post","link":"https:\/\/apimike.com\/account-take-over","title":{"rendered":"Account take over – ATO"},"content":{"rendered":"\n

ATO, or account takeover, is a type of fraud that occurs when a third party gains access to and illegally uses a victim\u2019s online account. This can happen if a malicious actor is able to obtain the victim\u2019s login credentials (username and password) or, in some cases, exploit vulnerabilities in the account management system to take over the account without the victim\u2019s knowledge. Once the account is taken over, the attacker can use it to commit fraud, such as making unauthorized purchases or transferring money out of the account.<\/p>\n\n\n\n

What companies are the targets of ATO attacks?<\/h2>\n\n\n\n

There’s no single profile of an ATO target, as the attackers will go after any organization that has valuable data that they can sell or use to extort a ransom. But healthcare organizations, financial institutions, and companies in the retail and hospitality industries are often the targets.<\/p>\n\n\n\n

These types of attacks are a growing problem as more and more businesses move their operations online. According to a report from the credit bureau Experian, ATO attacks increased by 71% between 2016 and 2017. And the problem is only expected to get worse as the number of online accounts and the amount of money being stored in them continues to grow.<\/p>\n\n\n\n

Definitive conclusions<\/h2>\n\n\n\n

There are a few definitive conclusions from an ATO attack, and at the top of these conclusions lies a simple fact, which is that there has been a significant increase in ATO attempts<\/a> in 2020\u20132021, with many organizations reporting increases of over 100% compared to previous years. The majority of ATO attempts target corporate accounts, followed by personal accounts. ATO attempts are typically carried out using phishing or social engineering techniques in order to obtain login credentials from the victim. Once an account has been taken over, the attacker will often use it to send spam messages or carry out other malicious activity.<\/p>\n\n\n\n

OWASP’s Top 10 and ATO<\/h2>\n\n\n\n

OWASP’s Top 10 is a list of the most common attacks against web applications. ATO would fall under the category of “Injection”, which is the third most common type of attack according to the Top 10. In order to prevent ATO, web developers should make sure to validate and sanitize all user input, as well as use strong authentication methods.<\/p>\n\n\n\n

How to protect yourself from ATO attacks<\/h2>\n\n\n\n

Fortunately, there are steps you can take to protect yourself from an ATO attack:<\/h3>\n\n\n\n
\"Account<\/figure>\n\n\n\n