Application Security // Database Security
2/15/2012
06:14 PM
Connect Directly
RSS
E-Mail
50%
50%

Bad Password Management Exposes Critical Databases

Nortel breach shows how poor password management can give away keys to the kingdom

As security experts analyze the ramifications of the nearly decade-long Nortel breach, one of the clearest lessons bubbling to the surface is that all of the encryption and vulnerability management in the world won't keep hackers out if they already have credentials to access sensitive databases. According to many experts, poor password management practices can cause a ripple effect that puts some of an enterprise’s most sensitive databases at risk.

In the case of Nortel, Chinese hackers were able to access sensitive data stores over the course of eight years after stealing passwords from a handful of top executives, including the company's CEO. The big question that many security professionals are asking today is, why weren’t those credentials ever changed during that long stretch of time?

“The issue of not changing passwords on critical infrastructure is epidemic,” says Phil Lieberman, CEO of Lieberman Software. “This is happening in most corporations all over the world.”

The combination of that common bad habit with increasing instances of cyberespionage such as this one is toxic for most enterprises, particularly if a malicious party learns the credentials of a super-user account.

“One issue I’ve been railing about for years is the issue of common credentials -- credentials that can get you into way too many things,” Lieberman says. “That credential might be on every machine or by inference be able to get you onto every machine; if that credential gets compromised, you lose everything.”

And by everything, experts warn, they don’t just mean the credit-card numbers and personally identifiable information (PII) that the industry has spent so much on to protect.

“We’re talking about the theft of extremely sensitive information relating to the status of the company, including research, business plans, and technical papers,” says Bill Morrow, executive chairman at Quarri Technologies. “The amount of damage that can be done in a single instance of a data breach is extreme; to imagine what Nortel is facing after years of hidden spying software is unfathomable and undoubtedly raises questions for many organizations as to the security of some of their more sensitive information.”

Lieberman agrees, saying this is a good learning lesson that hackers aren’t always just after PII.

“Sometimes there are things more valuable than credit-card numbers, and that is the IP and the business plans of a company,” he says. “For example, if you're bidding against them on a deal and you know what they're going to bid, this could give you a big advantage.”

Lieberman says that on the database front, organizations can limit their exposure by thinking about how credentials tap into critical systems.

“The big question is, when was the last time you changed the SA password? And the other issue is even if you’re not using SA passwords, most of the common databases today will accept credentials from things like Active Directory. If your CEO credentials are compromised and they have super-user access to the database, then there may be issues,” he says.

According to Morrow, not only should organizations think about those back-end concerns, but they also should look at locking down vulnerabilities that attackers could leverage to steal credentials from the browser-side front-end access points.

"Companies of all sizes are increasingly using browsers as the primary platform for the delivery of information, making browsers the primary point of theft or data leakage. Data can remain in the Web browser cache in clear text format, where it can be easily extracted by either malware or end users, even after the Web session has ended," he says.

"Additionally, stored user names and passwords from browser sessions remain available in the authentication cache and vulnerable to malware. Providing and enforcing the use of a secure, hardened browser session for your employees and customers is the best way to protect your data," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MS8699
50%
50%
MS8699,
User Rank: Apprentice
2/20/2012 | 6:47:51 AM
re: Bad Password Management Exposes Critical Databases
Companies of all sizes are increasingly using browsers as the primary platform for the delivery of information, making browsers the primary point of theft or data leakage.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.