Many cybercriminals try to break into corporate networks by guessing passwords, but a recently discovered malware dubbed Skeleton Key may let them simply make up one of their own.
A post from Dell SecureWorks Counter Threat Unit provided details on the threat, which is specific to Microsoft’s Active Directory service. It was described as an in-memory patch that lets cybercriminals compromise a system that only uses single-factor authentication for things such as Web-based email or virtual private networks. Worse, users may still log in with their original passwords even as cybercriminals access their data.
As an article on ZDNet explains, Skeleton Key is particularly worrisome because it could let cybercriminals pose as legitimate users inside an organization. Given that so many IT security problems are traced to insiders or former staff members, this could make it more difficult to trace those who have stolen information via the malware after the fact.
Forbes published an account of how this malware may have first popped up at a company based in London. Apparently, those using it would employ simple yet specific aliases for those they were attacking. The malware could be dated back to almost three years ago.
On the other hand, anyone attempting to use Skeleton Key will need to start over again once someone with an infected ad server shuts it down and activates it again, The Register noted. He or she will also need a password that governs domain administration, but if this is available in any physical areas of the organization — such as an IT department cubicle — it is possible that cybercriminals could try the same trick multiple times.
Some chief information security officers believe they are already well-protected by intrusion detection systems and the like, but as Dark Reading pointed out, Skeleton Key doesn’t create network traffic, so these types of products won’t help. And if cybercriminals were to impersonate someone from human resources or the senior management team, there might already be an authorization in place to access the information of various personnel. This means IT departments might not be quick to raise any questions or concerns.
If nothing else, Skeleton Key might be a good conversation-starter about the need for multifactor (or at least two-factor) authentication. This could include a physical hardware token, Computer Business Review suggested, or perhaps a soft token deployed on a smartphone. Otherwise, the only way to know whether your organization has been affected by this malware is to conduct a thorough information audit.