Sharing Passwords
Unfortunately, there’s no native way for a company to enforce that the password an end-user is using is unique to that account. Password complexity rules can only ensure that the password set is ‘complex’, but by no means was it not utilized with one of their personal accounts.
Beyond sharing passwords between work and personal accounts, administrators may end up sharing passwords within their environment. There have been plenty of times I was engaged with a customer assessing the password hygiene of their environment where we identified a user, “UserA”, was sharing a password between their ”UserA” account and their “UserA-adm” account. This is obviously a major concern. If someone were to get a hold of the non-admin account’s password, they could eventually find out through some reconnaissance that UserA has an admin account. They would try to gain access to that account as well.
Sharing passwords between shared mailbox accounts and meeting rooms is potentially less of an issue, but still a concern and something I’ve come across. Everyone needs to know the passwords to these accounts. Having them all shared makes it easier on the end-user, but what if, due to some poorly configured AD permissions, one of these accounts had access to do something they shouldn’t? Sharing passwords between these accounts gives an attacker a much larger attack vector. This is something we should be trying to nip in the bud.
Weak Passwords
While shared passwords are definitely a major concern, and are just as likely to end up in an attacker’s password dictionary from another platform that was breached, weak passwords are just as concerning. Password complexity rules only allow you to prevent so much. Enforcing length, character types (i.e. uppercase and lowercase letters, numbers, and symbols) and reuse can only take you so far. Preventing a user from using things that are easily guessed (e.g. their name, repeating characters, and patterns) is a huge part of cleaning up the password problem that may exist in your environment.
NIST Guidelines
The latest special publication 800-63B has an appendix devoted to the ‘Strength of Memorized Secrets’. These guidelines seem to contradict a lot of what we previously deemed necessary for good password hygiene. I will summarize my interpretation of the appendix below:
- Compare passwords against previous breaches
- Extremely complex passwords are not as effective as we thought
- Measures to prevent brute force attempts (rate-limiting) are more effective than complex and long passwords
- Users are encouraged to use ‘passphrases’, which means a large length and all special characters (including spaces) should be allowed
- Complexity rules force users to behave predictably (e.g. ‘password’ becomes ‘Password1!’)
- Prevent specific words such as the company name, the end-users name, etc.
Types of Password Attacks
There are plenty of ways an attacker can try to ‘attack’ your credentials. Most, if not all, of these vectors, can be locked down to an extent with proper training and security measures.
- Social Engineering – Phishing and other social engineering attacks are the primary sources of an attacker getting into your environment. A chain is only as strong as its weakest link, and that weakest link is one of your end-users. Proper training on phishing and other social engineering attacks will go a long way with your end-users.
- WDigest – Disabling WDigest across your environment to prevent plaintext passwords from being stored in memory is a big step in the right direction. If an attacker is able to get on a machine with local admin privileges, giving them the plaintext password along with a hash in memory will become much more dangerous as they’ll now have access to any interactive logon portals exposed in your environment.
- DCSync – Leveraging Active Directory permissions to perform a DCSync is one way an attacker can compromise credentials from your environment. Ensuring that only the necessary accounts have the capability to replicate your domain is an effective measure against DCSync attacks.
- Password Spraying – Password spraying attacks are a type of brute-force attack. Attackers use them to guess the passwords of user accounts in your environment. Rate-limiting policies will help prevent or slow down the success of a password spraying attack.