Credential Harvesting
Dictionary Term
Alternative Forms
Harvesting
Definitions
Definition 1
Credential harvesting is a class of cyberattacks characterized by collecting information on available authentication mechanisms (e.g., identity attributes, certificates, credentials, and sessions) to leverage this information to compromise information security domains and/or abuse identities.
Credential harvesting opportunistically seeks to find exploitable authentication solutions. It is distinct from attacks that target specific identities.
Credential harvesting may be used during various attack stages, including reconnaissance, initial exploitation, privilege escalation, and lateral movement.
Information collected by credential harvesting pertains to authentication-related information types that may be leveraged for exploitation, such as identity attributes, credentials, or session information. This comprises:
Email address
Login ID
Password
Password hash
Private key
Session ID
SSH key
The data sources from where credential information may be harvested vary. Typical ones are:
Computer memory (e.g., login ids, plaintext passwords, session tokens)
Configuration files
Databases
Documents (e.g., email addresses, login ids, passwords)
Email or application services that allow guessing attributes/dictionary attacks
Identity repositories (e.g., LDAP, Windows Active Directory)
People (through social engineering)
Phishing websites (e.g., login ids, passwords, second authentication factor)
Reusable identity attributes or credentials obtained from previous data breaches
Web cookies,
Web query parameters
Web sites, social networks, and forums (e.g., email addresses via web scraping)
Windows registry
Among these, some information may be publicly or easily available (e.g., email addresses that may be collected by web scraping on public websites or forums while others may be protected and harder to reach, e.g., cached credentials stored in computer memory.
The collected information may be insufficient for exploitation and may need to be complemented with other techniques (e.g., executing a dictionary attack on harvested password hashes).
Credential harvesting may be designated by the identity attribute or credential that is being harvested. Password harvesting specifically focuses on passwords. Email harvesting is a specialized and limited form of credential harvesting frequently used for phishing purposes.
Information may be collected:
by accessing it directly (e.g., when it is publicly or easily available (e.g., email addresses collected by web scraping or scanning configuration files),
by hacking it (e.g., accessing live memory to read cached credentials),
by guessing it (e.g., email addresses or login ids).
Threat actors engaging in credential harvesting may vary. They include:
Bots
Humans
Worms (ex: Nimba)
Example countermeasures that may be effective against credential harvesting include:
Access controls / need-to-know
Deception (canary identities, honeypots)
Disabling credential caching
Digital Rights Management (DRM)
Encryption
Hardware Security Module (HSM)
Multi-Factor Authentication (MFA)
Password Managers
Privileged Access Management (PAM)
Security awareness programs
System hardening
Sample Sentences
Eve, the hacker, tricked Bob, the user, by cleverly forging a spearphishing email. When Bob clicked on that link, he did not notice anything unusual but his laptop got compromised. Once in, Eve started to harvest credentials with the intention to make a lateral movement within Bob’s corporate network. Luckily for her, she quickly found the cached credentials of Alice, an engineer from the IT support team who previously logged in on Bob’s laptop to help him with a technical issue.
Conceptual Diagram
Related Terms
Credential
Identity Attribute
Password
Worm
Quotes
Bibliography
①
②
③
④
⑤
⑥
⑦
⑧
See Also
-
Bradley, 2019 (Bibliography)
-
Credential Harvesting (Dictionary)
-
Nemeth et al., 2011 (Bibliography)
