Weak passwords are detrimental to any organization’s security. This holds for commonly used passwords, passwords that are complex but are reused across services and applications, and even highly secure passwords that have been leaked.
(image credit – https://xkcd.com/2176/)
We strongly advocate for strong authentication methods on top of passwords, such as biometrics and multi-factor authentication, to boost password security.Having said that, to be effective, these methods must be applied consistently throughout the entire organization. And enterprises need a way to verify that this is the case.Often, enterprises will put tremendous effort into ensuring that their main services are secured correctly with multi-factor authentication and certificates while neglecting password security best practices when it comes to ‘side services.’ Often, the users of these services and applications are left to their own devices, and as a result end up relying on plain passwords and practicing poor cyber hygiene.Types of Password-Based Attacks
Password-based attacks come in many shapes. The following common types of attack can be prevented with stronger authentication methods.Bruteforce attack: To break into a specific account, a hacker uses a script to attempt to login with all possible password combinations. Brute force accounts don’t start randomly; they begin with the easiest-to-guess and most commonly used passwords.Password Spraying: A more opportunistic type of attack, password spraying attempts to break into any account from a large number of accounts matching the known usernames with a few commonly used passwords.As a result of massive stolen credential dumps that have been happening recently, high-volume password-spraying campaigns attempting to break into companies’ cloud accounts are becoming increasingly common.Password-spraying attacks are extremely dangerous because they often allow hackers to break into accounts without being locked out or triggering an alert to the IT team. Because password-spraying attacks don’t generate an alarm or lock out a user account, a hacker can continually attempt to match usernames with common passwords until they succeed.Credential Stuffing: This attack takes advantage of the fact that many users reuse login credentials across services. An attacker will use leaked username/password combinations from an unrelated service, attempting to login to the company’s cloud account with the same credentials. The attacker is hoping that some fraction of leaked credential users and the targeted organization will have some users in common who are guilty of reusing passwords.Credential stuffing is challenging to detect. Often, the only indication the victimized company has that they are being attacked is the rise in the overall volume of login attempts. Even then, the company will have difficulty stopping these attempts without impacting the ability of legitimate users to log in to the service.When successful, all of the attacks mentioned above can be extremely detrimental to a cloud-based organization.How Orca Prevents Breaches Due to Weak Passwords
Solving brute force and credential stuffing attacks with SideScanning (™) and Fuzzy Search
To stay one step ahead of the hackers and bolster password security, Orca’s patent-pending SideScanning™ technology accesses the organization’s block storage. It then attempts to match discovered passwords to commonly used passwords and known leaked password databases. For common passwords, we also perform offline brute force attacks to test how easy it is for a threat actor to break into the company’s accounts.Next, we perform a fuzzy search on the username in our extensive leaked password database. For the fuzzy search, we use the Damerau-Levenshtein edit distance algorithm.By fuzzy search, we mean, for example, that for the username johndoe@acme.com, we will try to match passwords from john.doe@acme.net, johndoe@gmail.com and so on. All of the passwords we discover will be checked against the hashed password to see if it matches. We then send an alert to the customer of their breached password and location.
