Hello and welcome to
another application of the minor
attack framework discussion
today we're looking at invalid
accounts within the initial
access phase of
the framework.
So let's go ahead and jump right in
to our objectives for today's
discussion.
So today we're going to be looking
at a few different areas we're going
to define and look at what
valid accounts are as defined within
Modder.
We're going to look at some types of
accounts that they define as well.
We've got some statistics that we're
going to look over together and kind
of discuss. This will help us to
better frame the importance of
the valid accounts vector and
some of the industry
statistics that go along with that.
And then, of course, we're going to
hit our wonderful mitigation
activities and detection activities
that we can do within each
of these areas.
So with that in mind, let's go ahead
and jump right in to our definition
area.
So what are
is a valid account?
What are valid accounts?
Well, valid accounts, Underminer
are accounts used by
users or services in
an organization threat act still
account information in a variety of
ways, and then use those credentials
to later gain access or
initial access.
In this case, as we're discussing
to the organization now,
these are just some generic
categories as provided is we know
there are different types of
accounts, depending on which you set
up in like a domain that can be a
domain administrator or
there can be service accounts that
run on the domain.
We've got local accounts, as you
know, that are just specific to an
individual system.
And then there are built in accounts
like guest accounts, administrative
accounts with
network equipment.
This could be like the admin
accounts that we see on Google when
we do searches for certain brands of
hardware and things of
that nature.
So what's important here
is that the level
of access that each of these account
types gives may not be
directly reflected by the type.
So a local account, for
example, can be an administrative
account.
It could be a limited access
account. It can be a service
account.
And then default accounts
are typically, as we said, those
that are built in.
So these are accounts that
come with hardware out
of the box.
And typically you have to
go in and enable or
create new accounts if you want
new accounts on the system.
Sometimes these accounts can be
disabled, sometimes they can't.
And you just have to implement
complex passwords and things of that
nature.
And then domain accounts
come in different flavors as well.
There could be accounts that are
domain administrators, which would
have, again, administrative access
as much like a local administrative
account or just typical
in user access.
Now the difference between, again,
local accounts and domain accounts
is that domain accounts are managed
by a central server
and provide access across all
systems in a domain.
So if you've got a system
in Europe
that connects back to
a central active directory
infrastructure and a
system in the US that connects to
that same infrastructure, in theory,
a user that travels to Europe
could access a workstation
in that domain, much like they would
in the US.
So you have to keep that in mind.
Now, let's go ahead and jump in to
some statistics.
So with
the Rawlence, the first statistic
here, they did a survey and found
that sixty five percent of
companies have over a thousand still
user accounts.
Now, typically, still user accounts
are accounts that haven't
been logged in to
for over 30 days.
And these are like active user
accounts.
And the reason that
this statistic is so troubling
is because if we don't have
some form of central monitoring
that's in place, there are
a thousand potential
and initial access
attempts. It could be made here.
These could be accounts
that were created for testing
purposes that were never disabled.
These could be accounts that are
from users that have come
and gone from an organization over
the years.
And they've never, of course, been
disabled either.
And that provides a
risk to the organization,
even if the password is changed
on these accounts, if the
administrator or person
managing the system uses
a weak password or doesn't
set the passwords to be
unique to each of those accounts,
then the ability of
a threat actor or even the user to
guess the password
or cracked the password becomes that
much greater. And that could be
risky, especially if these accounts
have.
Remote access capabilities to the
systems now
in Blackheart, twenty, seventeen,
thirty two percent of black hat
hackers admit that privilege
accounts are the number one way
to gain access to critical
data.
Now, this is,
I would say, rings true because
it's easier to find an account
that uses a weak password than
it is to develop a zero day attack.
It's easier to try admin,
admin or admin password
or admin blank
to get into
a piece of network equipment or a
firewall or
potentially a test account that was
set up like test test or printer
printer.
Seen a number of those over
the years.
And, you know,
it's the path of least resistance
in this case.
If I don't have to do
a heavy amount of vulnerability
research, if I don't have to do
buffer overflow attacks, if I don't
have to do any
type of manipulation and I log into
a system as a legitimate
user,
that's much easier and
better for me than trying to make a
bunch of noise and get into a
system.
And then our last statistic here is
from the Verizon data breach report,
which if you haven't looked
through this report before, Verizon
publishes it every year.
And I take the time to review some
of the statistics and kind of what's
popular year over
year as far as threat actors go and
what we're seeing in the industry.
So in the previous reporter, in the
actually the recent report, 80
percent of data breaches caused by
compromised and weak credentials.
So 80 percent of
data breaches are caused
by compromised and weak
credentials, meaning that
credentials were stolen, credentials
were reused elsewhere.
They're not subject to complexity
requirements and things of that
nature.
And so that's
a pretty high number.
Twenty nine percent involve
the use of stolen credentials.
Again, compromised, meaning
stolen.
In this case, password
dump was provided on the dark web or
something of that nature, or there
was just a listing of passwords that
came from another site.
And then an actor would
try to use those credentials across
other areas like banking sites and
things of that nature.
So.
And this comes back to good password
hygiene, good password complexity,
implementing dual factor things of
that nature, which we're going to
look at in our
mitigation activities
coming up.
All right, everybody.
Well, we're going to go ahead and
take a quick intermission.
The next part of our discussion will
be coming up.
Please stay tuned.