- So Ron, in the news, we always hear
about these big stories
about major companies getting breached
from Adobe to Dropbox, to LinkedIn.
And this seems to be almost an everyday recurrence.
So how are passwords actually stored
in these companies, in these systems?
- Sure, so at a very high level, most systems store
user credentials in some sort of
database or a text file.
With web applications often they store the credentials
in an SQL database
while in active directory, in an active directory domain
credentials are stored in a proprietary database.
- That makes sense.
So one of the recent Petya ransomware attacks
they used some type
of password attack in the, in their process.
What exactly was that?
- Yeah, so it's pretty interesting.
What they did was
of course they exploited the system initially
using the eternal blue exploit.
And then from there,
what the Petya attack did was, or the, the payload did
was it used a tool called Mimi cats.
What that does is it allows you to dump the credentials
out of memory.
And from there they utilized the credentials that
that they were able to steal
to attack the other systems
on the network using well known protocols like PS Exec
and WMI that are used all the time as in Windows.
So it looked like normal traffic.
So how do you defend
against these types of attacks John?
- It is understandably very difficult.
It's often a cat and mouse game
where we work on it from the defense side
and then a new tack comes out.
But basically there's two ways.
Passwords, we have to protect on both the storage side
and while they're being transmitted over the network.
So being transmitted over the network have to use some type
of encryption to ensure
that people listening in on the network traffic
can't just intercept that information and then storage.
There's various ways to protect the storage.
Operating systems
have their own protective measures in there.
There's also, you have to limit access to these
these storage mechanisms to only the people that
and the accounts that need access to that.
Also have your intrusion detection
endpoint protection, various auditing.
So you can look and see if anything looks fishy.
If people are accessing it
in ways that they really shouldn't be.
So there, there are various ways.
And then from an end user standpoint
to protect your own account
it's highly recommended to have longer passwords
and also enable two factor authentication when you can.