Blog

Passwords continue to be an issue for organizations as users use weak or breached passwords. Just recently, the Canada Revenue Agency (CRA) had a credential stuffing attack used against it in an attempt to gain access to 5,500 CRA accounts; some of the attempts were successful. As more credentials are disclosed in new breaches, the attacks against passwords will continue to rise as the pool of breached credentials give attackers more attempts to gain unauthorized access to accounts.

The probability of your employee using an identical or weak password for their personal accounts and your corporate ones may be higher than you think. However, there are solutions that can prevent this.

Web Application

Other than manually checking each password against a known list (e.g., blocking the top 1000 passwords), there is a free API solution by the creator of haveibeenpwned that allows you to limit the passwords accepted within your web application. It checks the inputted password against half a billion passwords that were previously breached in a unique and secure way, as described below.

Once the password check is completed, you can either educate your user but allow the password change, or force the user to select a stronger password that has not been breached.

Active Directory

To prevent users from using weak or breached passwords during a reset or account creation, SpecOps Software released a password policy tool that plugs into your Active Directory. It includes three controls to ensure passwords are as strong as they can be:

• Blocks weak passwords by checking previous breaches. Additionally, allows for the creation of a custom blacklist (e.g., Covid2020!)

• Allows for compliance driven templates to ensure compliance with NIST, SANS or PCI

• Blocks common character types at the beginning or end of passwords

More information can be found here.

Active Directory Audit

An Active Directory Audit will assess all the passwords within your active directory for any deviances in your password policy. Service accounts that never change their passwords would only be picked up by this type of audit. If the previous solution requires months of planning to deploy, the jump to an audit can be done immediately. We also recommend doing an audit even if the previous solution is deployed to ensure the controls are working as intended.

Completing the audit requires obtaining specific files from the domain controller (e.g., NTDS.dit and SYSTEM files) and using them to obtain hashes. We won’t get into the specifics but the general process involves obtaining and cracking hashes to uncover cleartext passwords. The cracking is dependent on the hardware used to crack, but generally, the weak passwords are cracked within seconds (e.g., mutations of password, welcome, spring, summer, fall, winter). Once the passwords are cracked, analysis can be done to provide value to the exercise. For example, at Packetlabs we use Pipal, which when run on the cracked passwords can provide the following information:

Sample AD Password Audit Statistics

The top 10 passwords are common among the audits we conduct and always come as a surprise to the clients when they receive the findings. The passwords are compliant with their password policy (e.g., length, capital letter, number, special character) but yet are easy to guess.

The need for all three of these solutions will ensure proper password controls are deployed across your web applications and end-user systems. If this is a service your organization is looking for or would like additional information about, please contact us.