Chasing a User's Identity

In the last chapter, you learned techniques to compromise a system. However, in the current threat landscape those techniques are often not even needed because instead, systems are simply compromised using stolen credentials. According to the 2019 Data Breach Investigation Report from Verizon, 29% of confirmed data breaches happened due to stolen credentials. This threat landscape pushes enterprises to develop new strategies to enhance the overall security aspect of a user's identity.

In this chapter, we're going to be covering the following topics:

• Identity is the new perimeter
• Strategies to compromise a user's identity
• Hacking a user's identity

Identity is the new perimeter

As was briefly explained in Chapter 1, Security Posture the protection surrounding one's identity must be enhanced, and that's why the industry is in common agreement that identity is the new perimeter. This occurs because every time a new credential is created, the majority of the time this credential is composed only of a username and password.

While multifactor authentication is gaining popularity, it is still not the default method used to authenticate users. On top of that, there are lots of legacy systems that rely purely on usernames and passwords in order to work properly.

Credential theft is a growing trend in different scenarios, such as:

• Enterprise users: Hackers that are trying to gain access to a corporate network and want to infiltrate without making any noise. One of the best ways to do that is by using valid credentials to authenticate, and be part of, the network.
• Home users: Many banking Trojans, such as the...

Strategies for compromising a user's identity

As you can see, identity plays a major role in how hackers gain access to the system and execute their mission, which in most cases is to access privileged data or hijack that data. The Red Team, who are responsible for assuming an adversarial role or perspective in order to challenge and improve an organization's security posture, must be aware of all these risks, and how to exploit them during the attack exercise. This plan should take into consideration the current threat landscape, which includes three stages:

During Stage 1, the Red Team will study the different adversaries that the company has. In other words, who can potentially attack us? The first step to answering this question is to perform a self-assessment and understand what type of information the company has, and who would benefit from obtaining it. You might not be able to map all adversaries, but at least you will be able to create a basic adversary profile...

Summary

In this chapter, you learned about the importance of identity for the overall security posture of an organization. You learned about the different strategies to compromise a user's identity that can be used by the Red Team. By learning more about the current threat landscape, the potential adversaries, and how they act, you can create a more accurate attack exercise to test the defense security controls. You learned about brute force attacks, social engineering using SET from Kali, pass-the-hash, and how these attacks can be used to perform lateral movement in order to accomplish the attack's mission.

In the next chapter, you will learn more about lateral movement, how the Red Team will use the hacker's mindset to continue their mission of mapping the network, and avoiding alerts.

References

1. Stealing Windows Credentials Using Google Chrome: http://defensecode.com/news_article.php?id=21.
2. Russian hackers selling login credentials of UK politicians, diplomats - report: https://www.theregister.co.uk/2017/06/23/russian_hackers_trade_login_credentials/.
3. Botnet-as-a-Service is For Sale this Cyber Monday!: https://www.zingbox.com/blog/botnet-as-a-service-is-for-sale-this-cyber-monday/.
4. How Anywhere Computing Just Killed Your Phone-Based Two-Factor Authentication: http://fc16.ifca.ai/preproceedings/24_Konoth.pdf.
5. Attackers Hit Weak Spots in 2-Factor Authentication: https://krebsonsecurity.com/2012/06/attackers-target-weak-spots-in-2-factor-authentication/.
6. Microsoft Windows CVE-2017-8563 Remote Privilege Escalation Vulnerability: https://www.symantec.com/security_response/vulnerability.jsp?bid=99402.
7. Pass-The-Hash Toolkit: https://www.coresecurity.com/corelabs-research-special/open-source-tools/pass-hash-toolkit.
8. Nimbostratus Tool: http...