Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

2/18/2016
04:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

The Secret Life Of Stolen Credentials

Bitglass Threat Research Team's Project Cumulus demonstrates what happens when Google Drive credentials are 'stolen.'

Everyone knows that stolen credentials can have disastrous effects on people's most critical accounts, but there's often no clear timeline for how exactly criminals put them to use. That changed this week with a new experiment from researchers with cloud access security broker (CASB) Bitglass, who put together a fictional digital identity and then leaked its credentials to the Dark Web to track the secret life of credentials once they're stolen.

This is the second-year running that Bitglass has done a "where's your data?" experiment. For this one, dubbed Project Cumulus, the Bitglass Threat Research Team created an online persona of an employee for a fictitious bank. This included creating a phony Google Drive account with fake bank data and files containing real credit card numbers and other data made to look like something someone would produce on the job. The drive was then tracked using Bitglass watermarks embedded in the files and its CASB technology in monitor-only mode.

From there, the team leaked the credentials for the Google Drive in a way that made it appear they were stolen during a larger phishing campaign. They found there was an immediate spike in activity when the credentials were leaked, with over 1,400 visits recorded to them and to the fictitious bank's Web portal.

From there, about 94% of the hackers who accessed the drive in question then also found the victim's other online accounts, including the faked bank Web portal. One in ten of them immediately attempted to log into Google itself with the Google Drive credentials in hand. And 12% of hackers attempted to download files containing sensitive content, with a handful cracking encrypted files after they were downloaded.

"Our second data-tracking experiment reveals the dangers of reusing passwords and shows just how quickly phished credentials can spread, exposing sensitive corporate and personal data," says Nat Kausik, CEO of Bitglass.

[Experiment tracked the Dark Web journey of a cache of phony names, SSNs, credit cards, and other personal information. Read What Happens When Personal Information Hits The Dark Web.]

Project Cumulus was the next step in Bitglass' experimentation on tracking stolen credentials or documents in the wild. Last year, it leaked watermarked documents and found these files were viewed 200 times in just the first few days of leaking. At that time, not many attackers used any methods to anonymize their traffic to the documents in question.

In stark contrast, this second incarnation had 68% of all logins coming from Tor-anonymized IP addresses.

 

Interop 2016 Las VegasFind out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
KeithB787
50%
50%
KeithB787,
User Rank: Apprentice
2/19/2016 | 3:11:59 PM
Hacking is truly a global threat
Very interesting article. It's incredible to see how fast and thoroughly the data was attacked by hackers – the first hack was within 48 hours and 1400 hackers were that interested in this data. It was also good to see the geographic location of those hackers – they were spread over 6 continents and located in 30 different countries.
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8813
PUBLISHED: 2020-02-22
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
CVE-2020-9039
PUBLISHED: 2020-02-22
Couchbase Server 4.x and 5.x before 6.0.0 has Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).
CVE-2020-8860
PUBLISHED: 2020-02-22
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S10 Firmware G973FXXS3ASJA, O(8.x), P(9.0), Q(10.0) devices with Exynos chipsets. User interaction is required to exploit this vulnerability in that the target must answer a phone call. T...
CVE-2020-8861
PUBLISHED: 2020-02-22
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue ...
CVE-2020-8862
PUBLISHED: 2020-02-22
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from the ...