Page 26 - Security Today, May 2017

CYBER ATTACKS
COMPANY CREDENTIAL Retailers exposed when employee reuse ID
By Michael Marriott
The retail industry has taken hard hits from cyber attackers over the last several years, thanks to the highly publicized Target and Home Depot hacks along with hundreds of other incidents—there were nearly 160 re- tail breaches confirmed in the most recent,
annual Data Breach Investigations Report from Verizon—the industry accounts for about 14 percent of all lost or stolen data records since 2013, according to an ongoing tally pub- lished by BreachLevelIndex.com. Among all sectors, that’s second only to the technology industry.
To lend further insight into the topic, Digital Shadows con- ducted an analysis of the top 1,000 companies on the Forbes Global 2000 list. With Digital Shadows SearchLight proprietary tool, the company was able to continuously monitor and collect corporate email/password breaches between April 2014 and June 2016 on social media, forums, “dark web” sources, criminal sites and “paste sites.”
Here are some results from businesses in the retail sector:
• There were an estimated 157,000 unique breached email and password combinations linked to retailers. The personal and household goods subsector accounted for the most (36 per- cent), followed by apparel (22 percent), food (21 percent) and
discount stores (10 percent).
• Many retail employees and execs re-use their corporate emails
for non-business or “unofficial business” outlets such as so- cial media. Therefore, it should come as no surprise that social media sites represented a wealth of the breaches, including LinkedIn (with more than 72,500 occurrences) and MySpace (more than 30,740).
• Outside of social media, we found nearly 42,000 leaks con- nected to Adobe and just over 3,200 to iMesh. Ashley Madi- son and other dating websites served as the source for more than 5,570 leaks—leaks which expose employees’ personally identifiable information (PII), partial credit card numbers and even their sexual preferences.
Why Data Breaches Matter
Our analysis probably comes as good news to cyber criminals, who are eager to leverage credential breaches to target the em- ployees’ organizations. Here are five incidents and trends which illustrate how:
Account takeover. The alleged re-use of passwords stolen dur- ing a LinkedIn breach led to a Dropbox attack. Workers neglect
to change passwords for years, using them for multiple services, making it too easy for hackers to take advantage.
Spear-phishing. In June 2016, Germany’s Computer Emergen- cy Response Team for federal agencies (known as CERT-Bund) reportedly detected spear phishing emails sent to executives. Threat actors crafted personalized emails using the target’s first name, last name, job role and company name to send malicious, macro-enabled Microsoft Word documents.
Credential-stuffing. This occurs when adversaries automati- cally inject breached user name and password pairs in order to fraudulently gain access to accounts. The adversaries then hijack the account for a variety of purposes, such as spamming in-boxes, stealing funds and accessing PII.
Post-breach extortion. Hackers collected more than 200,000 corporate email addresses during the 2015 Ashley Madison at- tack. The cyber criminals then tried to extort victims, threatening to reveal the information to victims’ partners if they didn’t send payments via Bitcoin.
Spam emails. These credentials are valuable for spam cam- paigns, easily swiping email addresses.
Companies Need a Plan
Enterprises must protect themselves from compromises linked to breached email accounts and passwords. Here are best practices to consider:
• Develop clearly stated policies to determine which kinds of
external services are allowable for corporate email accounts.
• Deploy an enterprise password management solution for
secure storage/sharing and password creation/diversity.
• Proactively monitor for “credential dumps” relevant to your
accounts.
• Establish multi-factor authentication for external corporate
services.
• Evaluate and document any internal services that aren’t feder-
ated for faster and more complete incident response.
• Implement an emergency password reset process to include all
user accounts.
• Through user behavior analytics tools, import compromised
identity information while detecting suspicious activity.
• Train your employees – and then train them some more.
By fully identifying and mitigating the practices which leave businesses vulnerable—and then investing in employee awareness training—you’ll greatly reduce risk while cultivating a more edu- cated workforce. That’s a win-win proposition in the age of cyber exposure.
Michael Marriott is a research analyst at Digital Shadows.
NS12
0517 | NETWORKING SECURITY