How One Compromised Login Can Take Over Your Entire Business Network

A single password can open up way more than people expect in a company system. Attackers often start there and keep going until they have control over most things. It seems like this pattern shows up again and again in the reports.

Credential misuse still counts as one of the main ways they get in according to that verizon data from last year. The part after the first access is usually where things get worse though. Most figure a lower level account keeps the damage small but it turns out that is just where it begins.

They look around from there to find better accounts with more power. I think the whole idea of limited access does not really hold up once they start moving. Some cases show it spreads further than anyone planned at first.

The Weak Point: How One Login Opens the Door

Many companies have these small ways in that do not seem like much by themselves. Like when someone uses the same password everywhere or a contractor account stays active when it should not be. Or a service account password that never gets updated. It seems like these are not huge problems alone but they can open up the whole system.

Phishing is still how most attackers get in at the start I think. There was this report from IBM about data breaches and it showed phishing and stolen passwords as big starting points. And when it starts that way it takes more time to find and stop the breach.

The more time they have inside without being noticed the more they can look around and find other problems to use. That part is pretty easy to miss sometimes.

From Basic Access to Full Control

Once an attacker has gained access to a system, in most cases, the attacker does not intend to simply have that same level of access as when they first made entry into the system. The common objective for attackers is to increase their level of access (escalate) so they can obtain access to sensitive information, disable security features, or move easily throughout multiple systems which may be interconnected. Therefore, privilege escalation via Windows based systems are critical components to the method by which breaches occur today.
A normal Windows based Business environment typically assigns differing levels of authority to users. For example, a “standard” user is generally limited to only accessing their own files and programs. In comparison, an Administrator account generally possesses all the authority necessary to perform the installation of new software, change various security settings, and access virtually anything contained within a machine. Typically, an attacker with access to a low-privilege user account will look for ways to rise in that hierarchy by exploiting poorly-configured permission settings, as well as unpatched vulnerabilities and poorly managed administrative credentials..

Attackers Using Common Techniques

Windows privilege abuse doesn’t rely on a single method. Attackers draw from a toolbox of techniques, adapting based on what the environment allows. Some of the most frequently observed approaches include:

1. There are different ways attackers can try to gain higher access on a system. Credential dumping is one approach where passwords or tokens get pulled from memory or files. I think that part is pretty common in a lot of attacks. 

2. Token impersonation lets someone hijack the security setup of a more privileged process or user. Unpatched vulnerabilities come up when known flaws in the operating system stay unfixed and get used. Pass the hash attacks allow reusing hashes to authenticate without the plaintext password ever being known. 

3. Exploiting misconfigured services happens when things run with too many permissions and that gets taken advantage of. It seems like some of these overlap in practice. Maybe the order they get used depends on what is available at the time. This part gets a bit messy if the system has multiple issues at once.

Each of these methods can allow an attacker to move from a limited account to one with administrative or even domain-level control, at which point they can often access every device connected to that network.

Why This Threat Is Hard to Detect

One reason why privilege escalation can be very harmful is because it looks a lot like the real thing when the administrator is taking action. The IT department will look at all of the obvious signs of an intrusion such as someone downloading files they do not need or connecting to bad (malicious) IP addresses etc., but in most cases you cannot catch the subtle signs of an intruder who has already escalated their privileges.

The tables below show a comparison between regular administrative actions and Windows privilege abuses; hopefully this information will assist your company’s IT department with identifying possible problems.

Indicator	Normal Admin Activity	Potential Privilege Abuse
Account creation	Follows documented approval process	New admin accounts created without record
Login times	Consistent with work hours	Logins at unusual hours or from new locations
Permission changes	Logged and reviewed periodically	Sudden, unexplained permission escalations
Tool usage	Standard IT management software	Use of credential-dumping or scripting tools
Access patterns	Limited to job-relevant systems	Broad access across unrelated departments

Because they may appear normal at first glance, many organizations do not find out the extent of a breach until there is extensive damage done. Research by the Ponemon Institute indicates that breaches using Privileged Credentials are generally one of the most costly types of breaches due to the access provided by an account once it is breached.

Building a Resilient Defense

Limiting your exposure to escalating breaches begins by limiting the amount of access that any single account requires. Implementing the Principle of Least Privilege (only providing the permissions necessary to perform the role) continues to be an extremely effective tool in reducing the potential for escalating breaches. Organizations can reduce their exposure to escalating breaches by regularly auditing administrative accounts, removing unused credentials, and implementing segmented networks. This will prevent a breach from occurring in one area of the organization from automatically granting the breacher access to other areas.

Implementing multi-factor authentication also creates additional barriers beyond passwords being compromised. Maintaining up-to-date patches on software systems also reduces the opportunities for an escalations technique to exploit existing vulnerabilities, which exist due to previously identified exploits. While no method provides absolute security, collectively these methods provide significant reduction in an attacker’s ability to escalate their footprint within an organization.

What We’ve Learned

The majority of large-scale breaches occur because of a singular initial compromise of an account or user ID. After a successful initial compromise, attackers are able to test boundaries, identify vulnerabilities and ultimately acquire greater levels of control over organizational resources. Identifying and understanding the ways attackers escalate their level of access into an organization allows for earlier identification of an attack potentially preventing its further expansion.