The Problem with “Attackers don’t break in, they log in”

For some reason it has become socially acceptable to say:

“Attackers don’t break in, they log in” — Microsoft CISO, 2019

I take issue with this phrase because it is a misleading half truth. A more accurate version would be:

“Attackers don’t break in, they log in (after purchasing the ability to log in from an attacker who did break in)”

Nobody “just logs in” to your network. Not unless you’re a UNIX terminal and the year is 1988. To log in you need credentials; typically a password, an API token, or a browser session token — at minimum. These have a distinct characteristic of not spontaneously appearing out of thin air. So where do they come from?

Well, attackers can make educated guesses about what your password might be — based on commonly used password structures e.g. surname followed by the last two digits of your date of birth. Or, they can do an exhaustive search of all the possible passwords you could’ve chosen from. Or, they can take a list of known common passwords and try all of those. There are many ways. But the important point is, these methods are as old as computers themselves — arguably related to the very reason why computers were invented in the first place — I digress.

What is new, relatively speaking, is the industrialisation of the cyber crime economy. It comprises supply chains where each participant provides a service to the next — for a fee.

The criminal who “just logged in” purchased credentials from an Initial Access Broker, who was sold the credentials by someone else.

The other person will be indiscriminately harvesting large quantities of credentials by infecting as many hosts as possible with info-stealer malware.

To do this they had to “break in”.

You see, someone had to break in to steal the creds. It may not be the same person who ultimately uses the creds, but someone had to break in nonetheless.

For the sake of completion, the info-stealer malware may well have been licenced or purchased from a Malware-as-a-Service provider, customised and then delivered to your mailbox using a commodity Phishing kit.

As a defender, it generally makes little difference who is doing what in this story. You are still interested in the same things you have always been interested in i.e. detecting initial access, execution, privilege escalation and credential access. What you’re not going to do is abandon this and focus entirely on monitoring for credential abuse in your cloud environments. If all you are looking for is the latter then it’s too late.