Account Credentials Are Child’s Play for Cybercriminals

The “Black Hat 2015 Hacker Survey Report” from Thycotic showed just how easy it is for attackers to steal privileged account credentials. According to the study, which was completed during this year’s Black Hat USA conference, 94 percent of cybercriminals find this information in unprotected files, including spreadsheets.

Keep in mind that the study is somewhat self-serving since Thycotic sells password access managers. But given the way IT can be its own worst enemy when it comes to security, it is worth taking a closer look at the survey results.

The study asked 200 hackers, who identified both as black-hat and white-hat types, what they thought about the state of cybersecurity. The vast majority — 75 percent — saw no improvement in the security of privileged accounts over the last two years. One-fifth of those surveyed found information about these accounts “all the time” in unprotected files, compared to only 6 percent that never found this information this way. The favorite target of their attempts are health care-related businesses.

Recommendations for Password Access Managers

The report did come with a solid set of recommendations to improve security practices around privileged password access. The four main points include:

  1. Discover rogue accounts and secure them immediately. Spend time tracking down all of your privileged accounts and bring them into one of the secure password access managers available on the market. For example, besides Thycotic, there are tools from Lieberman Software and Zoho/ManagedEngine that can accomplish this task.
  2. Rotate passwords on privileged endpoints constantly. Use the built-in automation of password access managers to do this.
  3. Actively audit and monitor privileged user access. It is still important to build a layer of monitoring around the use of those credentials in order to verify that they are used appropriately and not abused. Another tool that can be used for this purpose is Balabit’s Shell Control Box.
  4. Enforce strong password policies for end users. As the report stated, “While privileged accounts are the most coveted credentials to provide attackers critical data access, end user passwords are still an essential check mark in a hacker’s attack chain. Enforcing strong password policies on end user credentials helps protect those identities from being compromised during an attack.” One way to do this is to employ a single sign-on tool, which can create strong passwords and enforce corporate and IT policies.

Using password access managers is just the first step toward better security and is only one component of an integrated and holistic security policy. That said, it’s certainly a good one to take, especially if your shop has gotten sloppy about handling server and network infrastructure passwords.

More from Application Security

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

Self-Checkout This Discord C2

This post was made possible through the contributions of James Kainth, Joseph Lozowski, and Philip Pedersen. In November 2022, during an incident investigation involving a self-checkout point-of-sale (POS) system in Europe, IBM Security X-Force identified a novel technique employed by an attacker to introduce a command and control (C2) channel built upon Discord channel messages. Discord is a chat, voice, and video service enabling users to join and create communities associated with their interests. While Discord and its related software…

A View Into Web(View) Attacks in Android

James Kilner contributed to the technical editing of this blog. Nethanella Messer, Segev Fogel, Or Ben Nun and Liran Tiebloom contributed to the blog. Although in the PC realm it is common to see financial malware used in web attacks to commit fraud, in Android-based financial malware this is a new trend. Traditionally, financial malware in Android uses overlay techniques to steal victims’ credentials. In 2022, IBM Security Trusteer researchers discovered a new trend in financial mobile malware that targets…

Twitter is the New Poster Child for Failing at Compliance

All companies have to comply with privacy and security laws. They must also comply with any settlements or edicts imposed by regulatory agencies of the U.S. government. But Twitter now finds itself in a precarious position and appears to be failing to take its compliance obligations seriously. The case is a “teachable moment” for all organizations, public and private. The Musk Factor Technology visionary and Silicon Valley founder and CEO, Elon Musk, bought social network Twitter in October for $44…