Recorded Future provides real time threat intelligence to cyber defenders as well as business executives seeking insights to inform decisions. They leverage a patented Web Intelligence Engine over with billions of indexed facts (and more added daily) to analyze the open web to provide insights.
One category of the many sites they ingest is paste sites. These sites are web applications designed to allow users to store and share plain text. They are regularly used to hold and share small working documents by programmers/developers/systems administrators as well as academics and students. In practice, paste sites are also used as a dumping ground for stolen credentials. By applying algorithms over paste sites as well as over 650,000 other sources on the web, Recorded Future can provide enterprises with early warning that credentials have been compromised.
In a report titled “Government Credentials on the Open Web” Recorded Future provides insights and analysis showing 47 US government agencies across 89 unique domains have credentials leaked and made available to potential adversaries. Analysis and additional reporting by the government indicates that many of these agencies do not require multi-factor authentication, meaning lost credentials are a particularly risky threat in those cases.
We downloaded and reviewed the report and then sought to replicate the analysis and learn more by direct use of the Recorded Future application.
We began our evaluation by doing very simple queries of all paste type sites based on government email domains (for example, opm.gov). Starting with simple searches was a great way to generate foundational context. Immediately the visualizations of Recorded Future provided not just results on opm.gov domains but context around related data in the records. For example, a dump to paste sites from Dec 2013 which held opm.gov credentials also held credentials for 8 additional federal entities plus many of their key contractors and Recorded Future summarized the significance of that visually. It also provides a link to the data that was in the paste.
When miscreants steal or break passwords and paste them online it is an immediate threat and with this tool we can see it happening in very plain ways. We can also see the horrid state of user passwords. Here are a few that stood out: monkey, Marlene, brianna, turtles, dallaskid, redskins, buffy123, turkey. These are all horrible passwords!
I also conducted analysis around other domains, including organizations where I have worked in the past and those of many friends and associates. In almost every case there was information that would be of some use to adversaries who might use the information in phishing attacks and in some cases there was clear indication that passwords had been compromised.
Any organization that has leaked credentials is at increased risk, so using this method is a great way to inform defenders of the nature of threats and to take action to mitigate threats.
This same method can be used to look for indications of other types of leaked information, including supplier lists, contract data, customer lists, intellectual property, business strategies and other information meant to be protected. Which leads to the bottom line conclusion: Organizations should use the automation of Recorded Future to enhance situational awareness and drive continued action to improve security and reduce risks.
For more see: “Government Credentials on the Open Web”
Related Posts:
The Use of Recorded Future for Cyber Security Professionals(Opens in a new browser tab)
The Insider Threat Worst-Case Scenario(Opens in a new browser tab)
FBI Provides An Update On #SonyHack Investigation Including Some Tech Details On Attribution
