Password security is a critical issue, and the recent story of a UK-based security firm highlights the dangers of storing passwords in easily accessible locations. The firm, Reliance Cyber, shared a tale of a company that stored passwords in the description field of Active Directory, a common practice among developers. This practice is highly risky as it provides an enormous attack surface for hackers. The story begins with Rob Anderson, the head of reactive consulting services at Reliance Cyber, who recalls working with a firm that lacked a proper password vault for its service accounts. Instead, they stored the passwords in the description field of Active Directory, making it easy for team members to find what they needed. However, this practice is a major security lapse. Anderson explains that as soon as you have an Active Directory user, you can read the comments or description field across the entire Active Directory, which is a significant security vulnerability. This vulnerability was exploited by an Initial Access Broker (IAB), who used a phishing campaign and the offensive hacking tool Sliver to gain access to the victim's credentials. Once inside the Active Directory, the hackers found plenty of passwords, which gave them full domain access. They then deleted all backups and executed ransomware, putting 2000+ users out of action and taking the company offline for months. The lesson from this story is that passwords should never be stored in cleartext in easily accessible locations. Even without a phishing attack, an untrustworthy colleague could have sold the passwords to a threat actor. A recent survey found that one in eight workers think selling company logins can be justified, which further emphasizes the need for robust password security measures. Anderson also mentions that developers are becoming more aware of where they store their credentials, but security naivete can still sink ships. He advises that trust should be placed in no one, and that proper security measures should be implemented to prevent such attacks.
