04:00 PM
Connect Directly

The Secret Life Of Stolen Credentials

Bitglass Threat Research Team's Project Cumulus demonstrates what happens when Google Drive credentials are 'stolen.'

Everyone knows that stolen credentials can have disastrous effects on people's most critical accounts, but there's often no clear timeline for how exactly criminals put them to use. That changed this week with a new experiment from researchers with cloud access security broker (CASB) Bitglass, who put together a fictional digital identity and then leaked its credentials to the Dark Web to track the secret life of credentials once they're stolen.

This is the second-year running that Bitglass has done a "where's your data?" experiment. For this one, dubbed Project Cumulus, the Bitglass Threat Research Team created an online persona of an employee for a fictitious bank. This included creating a phony Google Drive account with fake bank data and files containing real credit card numbers and other data made to look like something someone would produce on the job. The drive was then tracked using Bitglass watermarks embedded in the files and its CASB technology in monitor-only mode.

From there, the team leaked the credentials for the Google Drive in a way that made it appear they were stolen during a larger phishing campaign. They found there was an immediate spike in activity when the credentials were leaked, with over 1,400 visits recorded to them and to the fictitious bank's Web portal.

From there, about 94% of the hackers who accessed the drive in question then also found the victim's other online accounts, including the faked bank Web portal. One in ten of them immediately attempted to log into Google itself with the Google Drive credentials in hand. And 12% of hackers attempted to download files containing sensitive content, with a handful cracking encrypted files after they were downloaded.

"Our second data-tracking experiment reveals the dangers of reusing passwords and shows just how quickly phished credentials can spread, exposing sensitive corporate and personal data," says Nat Kausik, CEO of Bitglass.

[Experiment tracked the Dark Web journey of a cache of phony names, SSNs, credit cards, and other personal information. Read What Happens When Personal Information Hits The Dark Web.]

Project Cumulus was the next step in Bitglass' experimentation on tracking stolen credentials or documents in the wild. Last year, it leaked watermarked documents and found these files were viewed 200 times in just the first few days of leaking. At that time, not many attackers used any methods to anonymize their traffic to the documents in question.

In stark contrast, this second incarnation had 68% of all logins coming from Tor-anonymized IP addresses.


Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
2/19/2016 | 3:11:59 PM
Hacking is truly a global threat
Very interesting article. It's incredible to see how fast and thoroughly the data was attacked by hackers – the first hack was within 48 hours and 1400 hackers were that interested in this data. It was also good to see the geographic location of those hackers – they were spread over 6 continents and located in 30 different countries.
Register for Dark Reading Newsletters
White Papers
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
According to industry estimates, about a million new IT security jobs will be created in the next two years but there aren't enough skilled professionals to fill them. On top of that, there isn't necessarily a clear path to a career in security. Dark Reading Executive Editor Kelly Jackson Higgins hosts guests Carson Sweet, co-founder and CTO of CloudPassage, which published a shocking study of the security gap in top US undergrad computer science programs, and Rodney Petersen, head of NIST's new National Initiative for Cybersecurity Education.