Leaked Credentials.

What are leaked credentials?

A credential is login information that ties an identity to something that proves it, such as a password. Leaked credentials are credentials that have escaped from where they should be kept. MITRE says credential exposure can happen through leaks to online or other accessible data sets, for example search engines, breach dumps and code repositories.

A breach dump is a collection of data taken from a breached service and then shared or published. The term “leaked” covers several cases. The owner may have lost control of the details through a breach, a mistake, or theft.

How do leaked credentials get used?

MITRE describes adversaries gathering credentials in several ways. These include phishing, buying credentials from dark web markets, and taking them from leaks. MITRE also notes that adversaries can exploit the tendency of people to reuse passwords across personal and business accounts.

MITRE lists credential stuffing as a technique in which adversaries use credentials from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. In plain words, a password leaked from one service may be tried on another.

Why does it matter?

MITRE says this kind of activity happens outside the reach of normal enterprise controls. It states that the technique cannot be easily mitigated with preventive controls, because it relies on behavior outside the scope of enterprise defenses. MITRE also says detection is hard, with high false positive rates and limited visibility. Because of this, an organization can find it useful to look at what is exposed and at the later stages of an attack, such as initial access.

How can you reduce the risk?

MITRE gives the following general advice.

• Reduce the amount and sensitivity of data that is exposed outside the organization, as MITRE suggests.
• Use multi-factor authentication on externally facing services, as MITRE advises for credential stuffing.
• Reset accounts whose credentials are part of a breach, as MITRE lists under user account management.

Failed sign-in attempts can also be a clue. MITRE’s detection notes for credential stuffing mention many failed attempts with different username and password pairs from one IP address.

Are leaked credentials the same as a data breach?

No. A data breach is an event in which data is exposed. Leaked credentials are one kind of data that can come out of such an event. A breach may expose many other kinds of information, and credentials can also leak without a breach of a service, for example through a code repository, which MITRE lists as a place where credentials may be exposed.

Are leaked credentials the same as credential theft?

Not exactly. Credential theft describes the act of taking credentials. Leaked credentials describes the state of credentials that are already exposed. Stolen credentials can become leaked ones when they are published or shared, but the two terms look at different points in the story.

Exposed logins can also be posted on paste sites.

Related terms

See also credential stuffing, credential harvesting and stealer logs.

Related pages in the Knowledge Hub

• Leaked credential monitoring
• Data leak detection

Sources

• MITRE ATT&CK: MITRE says credential exposure can occur via leaks to online or accessible data sets such as search engines, breach dumps and code repositories; adversaries can….
• MITRE ATT&CK: MITRE describes credential stuffing as using credentials from breach dumps of unrelated accounts to access target accounts through credential overlap, with….