Credential Harvesting
Dictionary Term
| Table of Contents | ||||
|---|---|---|---|---|
|
Alternative Forms
Harvesting
Definitions
Definition 1
Credential harvesting is a class of cyberattacks characterized by the collection of information related to identities, certificates, and credentials with the objective of leveraging this information to compromise or abuse these identities and/or the information system that these identities grant access to.
Credential harvesting targets indiscriminate identities and certificates within a certain scope in the hope of finding vulnerable ones and exploiting them. In this respect, credential harvesting is distinct from attacks that focus on specific identities or certificates.
Credential harvesting may be subdivided into two subclasses:Example information types that are collected by credential harvesting comprise any identity attribute or credential including:
Email address
Login ID
Password
Password hash
Private key
Session token
Credential harvesting for reconnaissance. This cyberattack consists of guessing or collecting identity attributes that are not sufficient to exploit identities but that are often publicly or easily available, e.g. email addresses collected by web scraping or login ids collected by guessing naming conventions. This attack may be used in the reconnaissance phase of a larger attack or for phishing purposes.
Credential harvesting for exploitation. This cyberattack consists of guessing or collecting confidential or vulnerable identity attributes or credentials such as passwords or session tokens that may be effectively leveraged to compromise identities in preparation for the exploitation phase of the attack, e.g. scanning configuration files for passwords, reading plaintext cached credentials stored in-memory, collecting session tokens from web cookies. This attack may be used for initial exploitation and/or lateral movement.
Credential harvesting may be designated by the identity attribute or credential that is being harvested, e.g.: email addresses harvesting or password harvesting.
Example identity attributes or credentials that may be collected as part of credential harvesting include:
Email address
Login ID
Password
Password hash
Private key
Example classes of threat actor classes who may engage in credential harvesting include:
Bots
Humans
Worms (ex: Nimba)
Example data sources used to harvest credentials:
Configuration files
Databases
Documents (e.g. email addresses, login ids, passwords)
Email or application services that allow guessing attributes/dictionary attacks
Identity repositories (e.g. LDAP, Windows Active Directory)
In-memory data (e.g. login ids, plaintext passwords, session tokens)
People (through social engineering)
Phishing websites (e.g. login ids, passwords, second authentication factor)
Reusable identity attributes or credentials obtained from previous data breaches
Web cookies,
Web query parameters
Web sites, social networks, and forums (e.g. email addresses via web scraping)
Windows registry
Example countermeasures that may be effective against credential harvesting include:
Access controls / need-to-know
Canary identities
Disabling credential caching
Digital Rights Management (DRM)
Encryption
Hardware Security Module (HSM)
Multi-Factor Authentication (HSM)
Password Managers
Privileged Access Management (PAM)
Security awareness programs
System hardening
Sample Sentences
Eve, the hacker, tricked Bob, the user by cleverly forging a spearphishing email. When Bob clicked on that link, he didn’t notice anything unusual when his laptop got compromised. Once in, Eve started to harvest credentials. Luckily for her, she quickly found the cached credential of Alice, an engineer from the IT support team who previously logged in on Bob’s laptop to help with a technical issue.
Conceptual Diagram
Related Terms
Credential
Identity Attribute
Password
Worm
Quotes
| Expand | ||||||
|---|---|---|---|---|---|---|
| ||||||
|
Bibliography
①
Anchor test-2021 test-2021 ②
Anchor test-2021 test-2021 ③
Anchor test-2021 test-2021 ④
Anchor test-2021 test-2021 ⑤
Anchor test-2021 test-2021 ⑥
Anchor test-2021 test-2021 ⑦
Anchor test-2021 test-2021 ⑧
Anchor test-2021 test-2021
See Also
| Filter by label (Content by label) | ||||||
|---|---|---|---|---|---|---|
|