An 18-year-old man form Wisconsin has been charged with a credential stuffing campaign against users of the popular US betting site DraftKings, in which he and others have stolen around $600,000 from 1600 victim accounts.
Joseph Garrison of Madison, Wisconsin, was charged with conspiracy to commit computer intrusions, unauthorized access to a protected computer to further intended fraud, unauthorized access to a protected computer, wire fraud conspiracy, wire fraud and aggravated identity theft.
Garrison is accused of launching the attack on DraftKings customers on November 18 last year. The charges against him carry a combined maximum sentence of 57 years.
Garrison used classic credential stuffing techniques in which he used stolen lists of usernames and password combos to try and simultaneously access accounts across the web that may have been used by the victims to login.
He managed to access 60,000 DraftKings user accounts using this method. In some instances, he was able to add a new payment method to an account, deposit $5 to verify that payment method and then withdraw all funds.
According to the US Attorney’s Office for the Southern District of New York, Garrison and his co-conspirators have stolen around $600,000 from 1600 victim accounts.
The law enforcement agency has searched Garrison’s home in February and they found credential stuffing software including 700 “config” files for dozens of targeted websites, as well as files containing 40 million login combos.
Moreover, the search also led to the discovery of at least 69 files (known as wordlists) containing roughly 38,484,088 username and password combinations, also used in credential stuffing attacks.
His smartphone also contained conversations with co-conspirators about how to hack the DraftKings accounts and extract funds.
Comments