Web security company, ImmuniWeb, has conducted research into the state of stolen credentials available on the Dark Web, which are being exploited by cybercriminals for spear-phishing and password re-use attacks against the highest-grossing global public and private companies - the Fortune 500.
ImmuniWeb used its all-in-one ImmuniWeb Discovery application discovery and inventory service solution to crawl generally accessible places and resources within the TOR network, across various Web forums, Pastebin, IRC channels, social networks, messenger chats and many other locations notorious for offering, selling or distributing stolen or leaked data.
Key findings: passwords
• Over 21 million (21 040 296) credentials belonging to Fortune 500 companies, among which over 16 million (16 055 871) were compromised during the last 12 months.
• As many as 95% of the credentials contained unencrypted, or brute-forced and cracked by the attackers, plaintext passwords.
• Perhaps unsurprisingly, technology was the industry with the largest volume of credentials exposed in breaches of adult-oriented websites and resources, followed by financials and energy.
• There were only 4,9 million (4 957 093) fully unique passwords amid the 21 million records, suggesting that many users are using identical or similar passwords.
• One of the most common passwords in most of the industries researched was password.
• Retail was the industry with the highest number of weak or default passwords.
• Approximately 42% of the stolen passwords are somehow related either to the victim’s company name or to the breached resource in question, making password brute-forcing attacks highly efficient.
• On average, 11% of the stolen passwords from one breach are identical - pointing to usage of default passwords, proliferation of spam and data scraping bots creating accounts, or a previous password reset setting an identical password to a large set of accounts.
Key findings: domains
• The number of squatted domains and phishing websites per organisation is proportional to the total number of exposed credentials. The more illegitimate resources exist, the more credentials can be found for the organisation’s personnel.
• The number of subdomains with failing Web security grade (C or F) is proportional to the number of exposed credentials. The more poorly secured a website is, the more credentials can be found for the organisation’s personnel.
Key findings: data
Over half of publicly accessible data is outdated or fake, or just comes from historical breaches in a false pretence to be newly compromised records.
The most popular sources of the exposed breaches were:
1.Third parties (e.g. websites or other resources of unrelated organisations).
2.Trusted third parties (e.g. websites or other resources of partners, suppliers or vendors).
3.The companies themselves (e.g. their own websites or other in-house resources).
Ilia Kolochenko, CEO and founder of ImmuniWeb, commented: “These numbers are both frustrating and alarming. Cybercriminals are smart and pragmatic, they focus on the shortest, cheapest and safest way to get your crown jewels. The great wealth of stolen credentials accessible on the Dark Web is a modern-day Klondike for mushrooming threat actors who don’t even need to invest in expensive zero-day or time-consuming APTs (the Klondike Gold Rush was a migration by an estimated 100 000 prospectors to the Klondike region of the Yukon, in north-western Canada, between 1896 and 1899). With some persistence, they easily break in, being unnoticed by security systems and grab what they want. Worse, many such intrusions can technically not be investigated due to lack of logs or control over the breached [third-party] systems.
In the era of cloud, containers and continuous outsourcing of critical business processes, most organisations have lost visibility and thus control over their digital assets and data. You cannot protect what you don’t see, likewise you cannot safeguard the data if you don’t know where it’s being stored and who can access it. Third-party risks immensely exacerbate the situation by adding even more perilous unknowns into the game.
A well-thought, coherent and holistic cybersecurity and risk management programme should encompass not just your organisation but third parties in a continuous and data-driven manner.
Full research and infographics at: https://www.immuniweb.com/blog/stolen-credentials-dark-web-fortune-500.html
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version