Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security //

Database Security

2/15/2012
06:14 PM
50%
50%

Bad Password Management Exposes Critical Databases

Nortel breach shows how poor password management can give away keys to the kingdom

As security experts analyze the ramifications of the nearly decade-long Nortel breach, one of the clearest lessons bubbling to the surface is that all of the encryption and vulnerability management in the world won't keep hackers out if they already have credentials to access sensitive databases. According to many experts, poor password management practices can cause a ripple effect that puts some of an enterprise’s most sensitive databases at risk.

In the case of Nortel, Chinese hackers were able to access sensitive data stores over the course of eight years after stealing passwords from a handful of top executives, including the company's CEO. The big question that many security professionals are asking today is, why weren’t those credentials ever changed during that long stretch of time?

“The issue of not changing passwords on critical infrastructure is epidemic,” says Phil Lieberman, CEO of Lieberman Software. “This is happening in most corporations all over the world.”

The combination of that common bad habit with increasing instances of cyberespionage such as this one is toxic for most enterprises, particularly if a malicious party learns the credentials of a super-user account.

“One issue I’ve been railing about for years is the issue of common credentials -- credentials that can get you into way too many things,” Lieberman says. “That credential might be on every machine or by inference be able to get you onto every machine; if that credential gets compromised, you lose everything.”

And by everything, experts warn, they don’t just mean the credit-card numbers and personally identifiable information (PII) that the industry has spent so much on to protect.

“We’re talking about the theft of extremely sensitive information relating to the status of the company, including research, business plans, and technical papers,” says Bill Morrow, executive chairman at Quarri Technologies. “The amount of damage that can be done in a single instance of a data breach is extreme; to imagine what Nortel is facing after years of hidden spying software is unfathomable and undoubtedly raises questions for many organizations as to the security of some of their more sensitive information.”

Lieberman agrees, saying this is a good learning lesson that hackers aren’t always just after PII.

“Sometimes there are things more valuable than credit-card numbers, and that is the IP and the business plans of a company,” he says. “For example, if you're bidding against them on a deal and you know what they're going to bid, this could give you a big advantage.”

Lieberman says that on the database front, organizations can limit their exposure by thinking about how credentials tap into critical systems.

“The big question is, when was the last time you changed the SA password? And the other issue is even if you’re not using SA passwords, most of the common databases today will accept credentials from things like Active Directory. If your CEO credentials are compromised and they have super-user access to the database, then there may be issues,” he says.

According to Morrow, not only should organizations think about those back-end concerns, but they also should look at locking down vulnerabilities that attackers could leverage to steal credentials from the browser-side front-end access points.

"Companies of all sizes are increasingly using browsers as the primary platform for the delivery of information, making browsers the primary point of theft or data leakage. Data can remain in the Web browser cache in clear text format, where it can be easily extracted by either malware or end users, even after the Web session has ended," he says.

"Additionally, stored user names and passwords from browser sessions remain available in the authentication cache and vulnerable to malware. Providing and enforcing the use of a secure, hardened browser session for your employees and customers is the best way to protect your data," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MS8699
50%
50%
MS8699,
User Rank: Apprentice
2/20/2012 | 6:47:51 AM
re: Bad Password Management Exposes Critical Databases
Companies of all sizes are increasingly using browsers as the primary platform for the delivery of information, making browsers the primary point of theft or data leakage.
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18942
PUBLISHED: 2021-02-26
Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to stored XSS. The application reflects previously stored user input without encoding.
CVE-2019-18943
PUBLISHED: 2021-02-26
Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations.
CVE-2019-18944
PUBLISHED: 2021-02-26
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS.
CVE-2019-18945
PUBLISHED: 2021-02-26
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escalation vulnerability.
CVE-2019-18946
PUBLISHED: 2021-02-26
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixation.