Passwords are part of life these days. The average person probably has hundreds of them鈥攁nd they鈥檙e all unique, right? RIGHT?!
So how are you expected to keep track of them all? Well, you could write all your passwords down in a file, save it to your desktop, and be sure to name it 鈥淢y Passwords鈥 for safekeeping.
While that may seem like a joke (and please, NEVER do that), our experience tells us that some users actually do this. They will save plaintext passwords to their desktops as an easy way to keep track of their credentials. Part of that is because they don鈥檛 have the proper security awareness training to understand the risk that this exposes them to, but there are others who know that they shouldn鈥檛 do this but ignore that advice anyway.
We know this happens. We鈥檝e seen this happen. But what the curious minds of the 杏吧传媒 Product team were most interested to know is how often this happens. Turns out, it鈥檚 way more common than we thought.
In early October, 杏吧传媒 responded to an incident where multiple unsecured password files were present that may have been accessed by adversaries. After responding to this incident, it got us wondering: how many other instances of plaintext documents (think Notes app, Word docs, Excel files, etc.) across our managed endpoints could potentially contain exposed passwords?
So, our team decided to conduct an assessment of our managed endpoints to detect any files that we believe contain stored plaintext passwords (note: 杏吧传媒 does not download or scan the file contents). The assessment was run across over 4,000 partner accounts, amounting to over 2 million total endpoints. Most of the analyzed endpoints were from small to medium-sized businesses.
We were somewhat shocked by the high rates of exposed plaintext passwords we found. Here鈥檚 what we uncovered:
To put this into perspective, this means that we found files with exposed plaintext passwords on over 32,000 endpoints. That鈥檚 32,000 endpoints with passwords that are easy to find, easy to access, and easy for hackers to steal. This poses a huge danger because these unencrypted files essentially contain the keys to things like business emails, bank information, sensitive user data, business-critical software log-ins, and the list goes on. And having this information out in the open is the ideal low-hanging fruit adversaries are after.
While security practitioners may well understand good cyber hygiene, there is a massive gap in education for users at small and medium-sized businesses. This presents an unfortunate opportunity for hackers to find low-hanging fruit to exploit.
Fortunately, there are simple steps you can take to reduce the risk of exposed passwords and account takeover.
While 100% protection is never possible in cybersecurity, this combination of tools and tactics will make it significantly tougher for hackers to gain access to your accounts.
With security awareness training, you can empower users to identify and prevent attacks like phishing, social engineering, and business email compromise at the source, while password managers and MFA add additional layers of security and protection to end users' passwords and accounts. If an adversary ever does gain access, having a tool to monitor your environment will allow you to identify and stop malicious behaviors before they can do any damage.
With the prevalence of potentially exposed passwords that we found through our initial scan, it was clear to us that we should make this a permanently available product feature for our partners. So, we have now baked this feature into our 杏吧传媒 Managed EDR offering.
Partners and customers leveraging 杏吧传媒 Managed EDR will be opted-in to 鈥淐redential Reports鈥 to receive alerts any time the 杏吧传媒 Platform detects a file that may contain exposed passwords. All accounts will be opted into this feature by default on 11/8 unless they opt out in Account Settings. Information on the feature and how to opt out (not recommended) can be found .
杏吧传媒 Security Awareness Training offers effective and engaging learning modules to help you educate your end users on cyber hygiene best practices (i.e., password management) and how to identify red flags like phishing scams and social engineering.
When attackers steal credentials, one of the most common ways they use them is by reusing them to conduct business email compromise (BEC). With 杏吧传媒 Managed ITDR, you can have peace of mind knowing that a 24/7 SOC of security experts is monitoring your Microsoft 365 environments for BEC and other account takeover threats.
Want to see if you have any exposed passwords in your environment? Take 杏吧传媒 Managed EDR (with the Credential Reports feature) for a test drive and experience the power of endpoint protection, detection, and response backed by our team of human security experts.
Get insider access to 杏吧传媒 tradecraft, killer events, and the freshest blog updates.
