Verizon DBIR: Stolen credentials led to nearly 50% of attacks

Protect exposed instances

The tactic of using stolen credentials was particularly persistent in BWAA, which the DBIR team defined as an actor "directly" targeting exposed instances, such as web servers and email servers. They also referred to it as a "low-cost, high-pay-off strategy," which is attractive to an array of attackers.

That might account for why more than 80% of the breaches in that category were attributed to stolen credentials and why it remains a problem today. One recent example occurred this month when DeadBolt ransomware operators targeted QNAP's exposed network-attached storage devices.

Another danger highlighted in the report is the lack of additional actions threat actors need to take once initial compromise of a web app is successful. Because of that, the DBIR team referred to web app attacks as a "get in, get the data and get out" pattern.

Pinto said the use of stolen credentials is almost exclusively the vector for these types of attacks, and if an enterprise suffers from a BWAA, it should definitely make securing credentials a top priority.

"It's not that someone has a zero-day [vulnerability] from Microsoft. You can only really get in with a credential," he said.

This method might even be popular among nation-state actors, based on more than 20% of BWAA breaches being attributed to cyberespionage campaigns, according to the report. "If the front door has a weak lock there is no reason to develop a complicated polymorphic backdoor with a fast flux network of C2 servers," the report said.

However, the vast majority of web app attacks were financially motivated. Threat actors also leveraged exploited vulnerabilities to gain initial access prior to a web application attack, though it was a small percentage compared with the use of stolen credentials.

Window of exposure closing in on flaws

The Verizon DBIR also highlighted a rise in vulnerability exploitation in 2021. The report noted that exploit vulnerability, which the DBIR team classified as an action variety, had both highs and lows last year.

"The action variety of Exploit vulnerability is up to 7% of breaches this year, doubling from last year," the DBIR read.

Pinto attributed the rise to threat actors' increased level of automation, which he referred to as "scary." One way to minimize the risk is to secure open ports, as actors initiate this attack by scanning for them, as well as to block potentially malicious IPs.

"Within hours of a vulnerability being published, or a CVE being public, you'll have some bots going through figuring out if the port is open, and then another one will try and see the version of the software that's vulnerable, and the third goes there and tries to exploit the vulnerability," Pinto said. "The turnaround is quick."

On the other hand, the report offered some positive news: The DBIR team said vulnerability remediation speed and completeness has increased over the last six years. "We're patching more and we're patching faster," the DBIR read.

One area that has not shown much improvement is misconfigurations, particularly related to cloud instances. Verizon noted that in 2015, the majority of user errors were classified as misdelivery of media assets, such as sensitive documents, while misconfigurations only accounted for less than 10% of breaches. But that breakdown began to shift more recently.

"The rise of the Misconfiguration error began in 2018 and was largely driven by cloud data store implementations that were stood up without appropriate access controls," the DBIR read. "Despite the efforts of the major cloud providers to make the default configurations more secure (which we applaud), these errors persist."

In 2021, misconfigurations and misdeliveries accounted for roughly the same percentage of breaches at approximately 40%. Nearly all of the 715 incidents analyzed by the DBIR team were confirmed to involve data exposure, most often personal data.

Securing the supply chain

Another top takeaway for Pinto was related to the SolarWinds breach in 2020 that affected high-profile victims including government entities. The attack, which took advantage of the common recommended security measure of updating software, was a cautionary tale of supply chain risks.

Pinto said that one big change in the 2022 DBIR was mostly due to SolarWinds and the deluge of incidents entered into the database from organizations that suffered an incident but not a full-blown data breach.

"It means that a very large number, 61% of system intrusion instances we had, stemmed from supply chain breaches. But actually, it was just from one supply chain breach: SolarWinds," Pinto said.

The level of threat actor automation Pinto mentioned was also present in the SolarWinds attack, where backdoors were hidden in automatic updates for Orion IT management software.

"There was a lot of fallout from the SolarWinds breach where thousands of companies had a specific botnet callback installed on their environment from the update that was tampered with. These things were beaconing out, and if you didn't do a good job of limiting access to your servers, there was potentially a way that threat actors could get in," Pinto said.

While one significant supply chain attack affected the data of the Verizon 2022 DBIR, Pinto said they did not observe anything that suggests an overall increase in these types of supply chain attacks. The DBIR team did not see many attacks outside of SolarWinds, which Pinto took as a sign that organizations are taking the threat seriously. There's increased pressure on vendors, he said, to improve work around securing their own estate and how it extends to third parties.

It is an area that the DBIR team will keep an eye on, Pinto said.

"We want to be able to tell over the years, now that it is on the forefront and there are real-life impacts that were proven by the SolarWinds attacks, that this is very much a thing people should be tracking and people should be concerned about," he said. "We want to make sure if a shift happens, if it becomes really popular, then it's something we can highlight for the future."