Bad Password Management Exposes Critical Databases

As security experts analyze the ramifications of the nearly decade-long Nortel breach, one of the clearest lessons bubbling to the surface is that all of the encryption and vulnerability management in the world won't keep hackers out if they already have credentials to access sensitive databases. According to many experts, poor password management practices can cause a ripple effect that puts some of an enterprise’s most sensitive databases at risk.

In the case of Nortel, Chinese hackers were able to access sensitive data stores over the course of eight years after stealing passwords from a handful of top executives, including the company's CEO. The big question that many security professionals are asking today is, why weren’t those credentials ever changed during that long stretch of time?

“The issue of not changing passwords on critical infrastructure is epidemic,” says Phil Lieberman, CEO of Lieberman Software. “This is happening in most corporations all over the world.”

The combination of that common bad habit with increasing instances of cyberespionage such as this one is toxic for most enterprises, particularly if a malicious party learns the credentials of a super-user account.

“One issue I’ve been railing about for years is the issue of common credentials -- credentials that can get you into way too many things,” Lieberman says. “That credential might be on every machine or by inference be able to get you onto every machine; if that credential gets compromised, you lose everything.”

And by everything, experts warn, they don’t just mean the credit-card numbers and personally identifiable information (PII) that the industry has spent so much on to protect.

“We’re talking about the theft of extremely sensitive information relating to the status of the company, including research, business plans, and technical papers,” says Bill Morrow, executive chairman at Quarri Technologies. “The amount of damage that can be done in a single instance of a data breach is extreme; to imagine what Nortel is facing after years of hidden spying software is unfathomable and undoubtedly raises questions for many organizations as to the security of some of their more sensitive information.”

Lieberman agrees, saying this is a good learning lesson that hackers aren’t always just after PII.

“Sometimes there are things more valuable than credit-card numbers, and that is the IP and the business plans of a company,” he says. “For example, if you're bidding against them on a deal and you know what they're going to bid, this could give you a big advantage.”

Lieberman says that on the database front, organizations can limit their exposure by thinking about how credentials tap into critical systems.

“The big question is, when was the last time you changed the SA password? And the other issue is even if you’re not using SA passwords, most of the common databases today will accept credentials from things like Active Directory. If your CEO credentials are compromised and they have super-user access to the database, then there may be issues,” he says.

According to Morrow, not only should organizations think about those back-end concerns, but they also should look at locking down vulnerabilities that attackers could leverage to steal credentials from the browser-side front-end access points.

"Companies of all sizes are increasingly using browsers as the primary platform for the delivery of information, making browsers the primary point of theft or data leakage. Data can remain in the Web browser cache in clear text format, where it can be easily extracted by either malware or end users, even after the Web session has ended," he says.

"Additionally, stored user names and passwords from browser sessions remain available in the authentication cache and vulnerable to malware. Providing and enforcing the use of a secure, hardened browser session for your employees and customers is the best way to protect your data," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.