A password manager is still the right answer for most people. It is also a high value target, which is why MITRE ATT&CK lists Password Managers as technique T1555.005. The tactic is credential access, and the platforms are Linux, macOS and Windows.
How attackers use it
Password managers store credentials, normally in an encrypted database. The database opens after the user enters a master password, and once open, credentials may be copied into memory. The databases can also exist as files on disk.
MITRE describes two routes. First, extracting the master password or plaintext credentials from memory, which may use Exploitation for Credential Access (T1212). Second, brute forcing the master password through Password Guessing (T1110.001).
Both routes depend on time and exposure: how long decrypted data stays in memory, and how weak the master password is.
How to detect it
MITRE lists no data sources here. Look for processes accessing the memory of the password manager client, copies of vault files to unusual locations, and repeated failed unlock attempts where your tool reports them. Endpoint tooling that flags cross process memory reads is the most direct control.
How to reduce the risk
MITRE lists five mitigations.
- Update software. Keep browsers, password managers and related software current.
- User account management. Use strict account policies and audit accounts so inactive ones are disabled.
- User training. Teach safe password manager use and how to spot phishing aimed at credentials and session cookies.
- Software configuration. Re-lock password managers after a short timeout, which limits how long plaintext credentials stay in memory.
- Password policies. Follow NIST guidelines when setting master password requirements.
The auto-lock setting is the cheapest win. Set a short timeout through policy if your tool supports it, and make the master password long and unique.
Quick check
Why does an auto-lock timeout help?
When the manager is unlocked, credentials may be copied into memory. Re-locking after a short period shortens the time plaintext credentials are available to be extracted.
