Latest / CYBR.Signal / Password Managers and Credential Stuffing: Not a Good Combo

Transcript

Password Managers and Credential Stuffing: Not a Good Combo · CYBR.Signal

• 0:00
  SPEAKER_00: And hello everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: Michael Farnum here.
• 0:03
  SPEAKER_00: Hope you're doing well.
• 0:04
  SPEAKER_00: This is the first Cyber Sunday of 2023.
• 0:07
  SPEAKER_00: So thank you for coming back and listening to my ramblings.
• 0:11
  SPEAKER_00: So I had an idea around this Cyber Sunday, and it was going to be focused on kind of the attacks and um the plumbing, if you will, around identity and those kind of things.
• 0:24
  SPEAKER_00: I'm specifically talking about uh the LastPass, Norton Password Manager, Norton Lifelock Password Manager, and then the Circle CI, which was which is a CICD development pipeline tool chain uh type of product service, I guess if you will.
• 0:42
  SPEAKER_00: Um, and I I started looking at all that, and then something just caught my eye because all these are fairly recent.
• 0:48
  SPEAKER_00: So I think it was just a couple of days ago or late last week, Norton Life Lock came out and said that their password manager uh had been, they'd had some trouble seeing a lot of attacks happening on it.
• 1:00
  SPEAKER_00: And specifically what was happening was credential stuffing.
• 1:04
  SPEAKER_00: So if you're not familiar with credential stuffing, it's where someone has stolen a list of passwords or full credentials, generally username password that they know work on other sites and are taking those and stuffing those generally into other services or products, hoping that somebody reuses their password.
• 1:29
  SPEAKER_00: Very common type of attack, very similar to when brute force was used a lot, though generally that was just kind of a bunch of commonly used, you know, passwords that were off of a password list or something.
• 1:41
  SPEAKER_00: But these are known credentials, very common to use.
• 1:45
  SPEAKER_00: There's a lot of stolen credentials going out in out on there on the dark web.
• 1:49
  SPEAKER_00: A lot of people have them out there for sale.
• 1:52
  SPEAKER_00: Okay, known attack.
• 1:54
  SPEAKER_00: We know it's a problem.
• 1:56
  SPEAKER_00: You shouldn't reuse your username and password, right?
• 2:00
  SPEAKER_00: You absolutely well, hold on, before I go on a rant, let me state that I am not one of those people that's a stupid user type of person.
• 2:08
  SPEAKER_00: I believe, especially in the enterprise, we've got a lot to do from the practitioner side to make things easier so users don't make some of those mistakes that could be mediate remediated using some kind of technology or process.
• 2:24
  SPEAKER_00: Okay, that's out of the way.
• 2:25
  SPEAKER_00: I am not one of those people that's stupid user, stupid user, stupid user.
• 2:29
  SPEAKER_00: However, if you are going to use a password manager, why in the world would you use a username and password from another or reuse your credentials from another service in a password manager that has probably, if not all, a big majority of your passwords in it that would then give an attacker access into all the other stuff you use.
• 3:02
  SPEAKER_00: I mean, honestly, I would rather you not use a password manager if that's the way you're gonna do it.
• 3:08
  SPEAKER_00: Because it kind of gives password managers a bad rap when you can't, for just one service, use a very unique username and password.
• 3:22
  SPEAKER_00: Literally, password managers are designed to give you perfect, if not close to perfect if not perfect, perfectly random generated passwords for whatever system you've got them on.
• 3:35
  SPEAKER_00: And I know not everything works exactly perfectly with a password manager.
• 3:40
  SPEAKER_00: Sometimes there are issues with it, I get it.
• 3:43
  SPEAKER_00: But that doesn't matter, that doesn't mean you go and use the same username and password password for your password manager with all your passwords in in it as you do any other system.
• 3:55
  SPEAKER_00: Literally, you could change your whole way of doing things if you would just use one a password manager and one username, one password that are strong.
• 4:05
  SPEAKER_00: This is not difficult.
• 4:06
  SPEAKER_00: Again, I'm not a stupid user person, it just I just had to go on around about it.
• 4:12
  SPEAKER_00: I'll talk about the other thing where people are going through kind of the plumbing and attacking these.
• 4:16
  SPEAKER_00: By the way, this is not the same attack that happened with uh LastPass.
• 4:22
  SPEAKER_00: LastPass was a different type of attack.
• 4:24
  SPEAKER_00: They found some stuff where they had I can't remember all the details, but they had some stuff in a cloud backup.
• 4:29
  SPEAKER_00: They did not get their master passwords, any of that stuff.
• 4:32
  SPEAKER_00: But this absolutely could happen on LastPass.
• 4:36
  SPEAKER_00: So just to clear it up, Norton said that this was not an attack on or they did not get the usernames and passwords from their system, they got them from other systems, and then people reused them to attack Norton, and they were they were successful.
• 4:49
  SPEAKER_00: That's the whole thing.
• 4:50
  SPEAKER_00: There were multiple, they didn't say how many, but multiple accounts that were you reusing usernames and passwords from other things to secure their password manager.
• 5:00
  SPEAKER_00: Just flabbergast me.
• 5:02
  SPEAKER_00: Don't do that, please.
• 5:04
  SPEAKER_00: Don't do that.
• 5:06
  SPEAKER_00: Okay.
• 5:07
  SPEAKER_00: Alright.
• 5:08
  SPEAKER_00: Sorry for the rant, but it just got me going.
• 5:12
  SPEAKER_00: Okay.
• 5:13
  SPEAKER_00: Again, happy new year, happy Cyber Sunday.
• 5:16
  SPEAKER_00: I'll talk to you next time, maybe in a better mood.
• 5:18
  SPEAKER_00: Alright, thanks everybody.
• 5:19
  SPEAKER_00: Bye bye.