Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics //

Security Monitoring

Keep Watch On Accounts For Stolen Passwords

Log management and a well-refined ruleset can help companies pinpoint suspicious activity on accounts that suggest a password compromise

In the past week, three major online consumer services have acknowledged that their systems were breached and passwords leaked. The litany of incidents is a good reminder that companies should take another look at how they are managing and monitoring the access to their systems.

On Wednesday, social network LinkedIn confirmed that some of the 6.5 million password hashes leaked online belonged to users of its social network. Researchers have confirmed that the passwords were not mathematically hashed using an additional seed, or salt, allowing researchers to easily decrypt some 60 percent of the passwords in 48 hours. Two other companies, online dating service eHarmony and music service Last.fm, reportedly confirmed that some users' account credentials had also been leaked or stolen.

All three incidents demonstrated that the companies failed to monitor properly for suspicious access to their systems and password files, says Nick Percoco, senior vice president at security service provider Trustwave and the head of the company's SpiderLabs.

"All of these organizations found out about the leak because someone reported it to them," Percoco says. "Someone posted it on the online in a forum. And, if you are at LinkedIn, you heard about the incident at the same time that some like me did."

[A hacker claims to have infiltrated the personal Hotmail and Dropbox accounts of Republican presidential candidate Mitt Romney, after guessing his "favorite pet" security question to change the password. See Hacker Says He Accessed Pair Of Presidential Hopeful Romney's Online Accounts.]

It's not an uncommon problem. More than 90 percent of breaches were reported to a company by a third party, according to Verizon's 2012 Data Breach Investigations Report. Moreover, 84 percent of breaches left signs of the compromise in log files, and all but 3 percent of the breaches could have been stopped by simple or intermediate controls, the report stated.

Mine, your, logs
The Verizon data has a simple lesson for companies: Organizations that monitor logs for the right events will be able to catch suspicious accesses in their systems.

What's suspicious? That depends on your users and their use cases, says Joe Siegrist, CEO of online password service LastPass. Employees who suddenly log in from another country, use a different device, attempt to access restricted systems or are using a proxy service should all raise a red flag, or at least contribute to some cumulative factor of suspicion.

"If both their activity is an outlier as well as other elements you are tracking, ... then you should be more likely to suspect fraud," says Siegrist. "If you have an employee that normally does X, Y, and Z, and they are coming from a new location and doing things that they might not normally do, that should raise suspicions."

The least expensive way to monitor for such anomalies is to monitor log files and filter events using rules to detect abnormal behavior by users. Defining "abnormal" can be difficult, however. That's where systems that create fingerprints of standard users can come in handy. Alternatively referred to as adaptive analytics or adaptive authentication, the technology was first used by financial institutions to detect fraud on credit card accounts.

"Adaptive analytics is a state engine that watches what users are doing, and making sure that their patterns of behavior makes sense," says Darren Platt, chief technology officer with Symplified, an identity and access management company. "It's not just the applications they access, but the locations they are accessing from and what devices they are using when they access."

Don't just watch, do more
Companies should not stop at monitoring their access logs for signs of password abuse, however.

Starting with education, companies should teach their employees that each password should be complex and used only once. Companies should then create policies to enforce their security controls, including locking out accounts after a certain number of password attempts and adding authentication methods if anything appears suspicious.

In addition, companies should consider adopting two-factor authentication to lessen the chance that a compromise password will lead to a compromise of the corporate network.

Finally, companies that are monitoring their logs should make sure they have updated any detection rules for account access.

"Hackers are obviously going after password files and companies need to have systems in place that are monitoring the files," says Trustwave's Percoco. "Companies should take the time to tune them, so they can proactively see these attacks happening."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
skswave
50%
50%
skswave,
User Rank: Apprentice
6/10/2012 | 1:36:24 AM
re: Keep Watch On Accounts For Stolen Passwords
The issue is it is time to move away from PW for most access control. the right choice is to use the TPM in your PC. Does SSL IPSEC, 802.1x, windows domain, Smart card emulation today.
You already have one in your business PC
It's industry standard
and it's very inexpensive to use 1/2 to 1/3 the cost of tokens

Only Known devices on the network is what makes it so cheap to run a carrier or a cable company compared to an enterprise thin 50 per year not 1000 per year for known devices with whitelisted software.
Eric_Brown
50%
50%
Eric_Brown,
User Rank: Apprentice
6/11/2012 | 12:28:21 PM
re: Keep Watch On Accounts For Stolen Passwords


I have been a
strong supporter of 2FA for some time now, and I wish these sites and ones like
them would be more security conscious, not just say they are. They need to
prove it by actions, not words. -It would
be great to see them, just as so many other leading companies in their
respective verticals are doing by giving us the perfect balance between security
and user experience and moving to the use of 2FA (two-factor authentication) whether
mobile or other, as a form of a token where the user is asked to telesign into
their account by entering a one-time PIN code which is delivered to your phone
via SMS or voice. I enjoyed your article. These organizations need to start
being held responsible for their actions, and only way that will happen is if
we as user voice our opinion.
Bprince
50%
50%
Bprince,
User Rank: Ninja
6/21/2012 | 4:29:04 AM
re: Keep Watch On Accounts For Stolen Passwords
I agree that two-factor authentication bolsters security. Even that though has its flaws. For example the recent situation where the Google Apps' account recovery feature was exploited to hijack the account of the CEO of CloudFlare. That attack succeeded because -the attackers were able to fool AT&T into forwarding his voicemail to another account.
Brian Prince, InformationWeek/Dark Reading Comment Moderator-
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15208
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can ...
CVE-2020-15209
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one....
CVE-2020-15210
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and ...
CVE-2020-15211
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices f...
CVE-2020-15212
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `outpu...