A password store is a convenience that also concentrates risk. Everything a user or service needs to sign in sits in one place, which is exactly where an attacker looks. MITRE ATT&CK technique T1555, Credentials from Password Stores, is the parent of several sub-techniques. The tactic is credential access, and the platforms are IaaS, Linux, macOS and Windows.
How attackers use it
MITRE describes adversaries searching common password storage locations for user credentials. What counts as a store depends on the operating system or application. Some are built in. Others are applications and services designed to store passwords so they are easier to manage, such as password managers and cloud secrets vaults. Once obtained, credentials can be used for lateral movement and to reach restricted information.
The sub-techniques split the stores up:
- Keychain (T1555.001) and Securityd Memory (T1555.002) on macOS
- Credentials from Web Browsers (T1555.003)
- Windows Credential Manager (T1555.004)
- Password Managers (T1555.005)
- Cloud Secrets Management Stores (T1555.006)
How to detect it
MITRE lists no data sources on the parent page. Detection depends on the store, so use the sub-technique posts for specifics. Cross-cutting signals include processes reading credential files that they do not normally touch, bulk reads from a secrets vault by an identity that rarely queries it, and use of a credential from a place or time that does not fit its owner.
For stores with an audit log, such as cloud secrets managers, turn it on and alert on reads from new principals.
How to reduce the risk
MITRE lists these mitigations for the parent technique.
- Privileged account management. Limit the number of accounts and services allowed to query password stores to those that need it. Make sure each only has access to the secrets it requires.
- Update software. Regular updates reduce the risk of exploitation.
- Password policies. On macOS, the login keychain password can differ from the user's login password, which forces an adversary to learn a second password. MITRE also suggests weighing the risk of storing credentials in password stores and web browsers at all. If disclosure is a significant concern, technical controls, policy and user training may be used to prevent storage there.
The principle underneath all three is to reduce how much is in any single store and how many identities can open it.
Check your own environment
A short checklist:
- List who and what can read each secret store you run, and remove anything that cannot justify access.
- Confirm audit logging is on for your cloud secrets manager and that someone reviews it.
- Decide on a policy for browser saved passwords on managed devices.
- Confirm devices and password manager clients are on current versions.
Quick check
Why does limiting which services can query a password store reduce risk?
An attacker who compromises any permitted account or service inherits its access. Fewer permitted identities, each with access only to the secrets it needs, means a smaller set of secrets exposed per compromise.
