It’s bad enough when hackers get their hands on one of your accounts or logins. But sometimes they can use one stolen password to steal many of your other passwords as well. If your computer is on a network, they may be able to steal other users’ passwords too.
This is achieved using a technique called credential dumping. We’ll explain how it works and how to protect yourself from it.
What Is Credential Dumping?
Recently security researchers have been talking about the dangers of credential dumping. This is a technique used by hackers to access multiple accounts from one person.
It begins when hackers get access to a victim’s computer. From this one computer, they are able to extract usernames and passwords for multiple accounts. These could include logins for bank accounts, email accounts, and login information for other machines or networks.
This can make it easier for hackers to steal someone’s identity and take over all of their accounts. They can also use this technique to grab login details for other users on the network, spreading a vulnerability from a single machine to an entire system.
How Are You at Risk of Credential Dumping?
It is possible for hackers to access many passwords when they access a computer due to the way operating systems handle passwords. Your operating system doesn’t want to annoy you by asking for passwords all the time, so once you have entered a password it is stored in the computer’s memory for later use.
If the hacker is able to access a file called the Security Account Manager, they can see a list of the passwords stored on that computer. The passwords are hashed, meaning each character is transformed into something else to hide it. This is the same process used for passwords on secure websites. But if the hashing is not strong enough it can be broken for each stored password. Then the hacker will have access to all the different accounts for that user.
If another user has logged onto the same machine, the hacker might be able to find their passwords too. If a business user has problems, they may call IT support and get a network administrator to come and check their machine. Once the network administrator logins in to a compromised machine, the hacker can steal the administrator’s login information as well and do more damage.
How to Protect Yourself From Credential Dumping
You can see the threat posed by credential dumping. But there are some simple steps you can take to protect yourself and your device from this technique:
1. Don’t Store Your Passwords on Your Computer
A bad habit many people have picked up is storing all their passwords in an unencrypted text file on their hard drive. They know that they mustn’t use the same password for multiple sites, and that passwords should be hard to guess. So they use random passwords. But they can’t remember all of them so they write them down in a file on their computer.
The reason this is a problem is that if an attacker accesses that one text file, they have access to all of your passwords for every site. This is a big security risk and makes credential dumping very easy, so it should be avoided.
2. Use an Online Password Manager
So if you shouldn’t store passwords on your computer, what should you do with them? It’s a good idea to use a trustworthy online password manager like LastPass or 1Password.
Online password managers work by storing your credentials online. This data is encrypted before it is uploaded to the internet, so you can access your passwords from any device. This has the advantage of protecting you from credential dumping. But it can also be a disadvantage; if someone finds out the master password for your password manager, they can access every single one of your accounts.
On balance, an online password manager is the option that many people choose for the best security. But you need to be very careful with your master password and make sure you never write it down anywhere, either on a computer or on paper. This is one password you really need to memorize.
3. Enable Microsoft Defender
If you’re a Windows user, you should definitely make sure Microsoft Defender, Microsoft’s antivirus solution, is enabled. There’s even a version of Microsoft Defender available for Mac.
Microsoft says that Defender will protect against credential dumping by protecting the lsass.exe process which is the target of many credential dumping attacks. When you enable Defender, it will run automatically in the background to protect your computer.
Defender should be enabled by default on Windows machine. To check, go to Settings in Windows, then to Update & Security. Choose Windows Security from the menu on the left. Now click Open Windows Defender Security Center. Here, check that Virus & threat protection and Account protection are enabled.
4. Use Two-Factor Authentication
One of the best ways to protect yourself from password theft is to use two-factor authentication wherever possible. This means that when you go to log in to a site, you first enter your username and password. Then, if the password is correct, you enter a second piece of information.
Usually, you will enter a code that is generated by an app on your phone. Alternatively, you can enter a code which is sent to your phone via SMS.
The idea is that even if an attacker knows your password, they don’t have access to your phone or your email. The only way to access your account is when you have both the password and access to your device.
The annoying thing about two-factor authentication is that you have to enable it individually on every site you use. But you should definitely start by enabling it on your most essential websites, like your email account, your online banking, and PayPal or other payment services.
Beware the Threat of Credential Dumping
Credential dumping is a technique used by hackers to steal passwords for multiple accounts when they have accessed one computer. It can happen because of the way operating systems store passwords once you have entered them.
You can protect yourself from this threat by using a password manager, enabling Microsoft Defender, and enabling two-factor authentication.
To learn more about how passwords can be compromised, see our article explaining the most common tactics used to hack passwords.
Read the full article: What Is Credential Dumping? Protect Yourself With These 4 Tips
Comments
Post a Comment