Credential dumping is a type of cyber attack where a computer is breached and usernames and passwords are obtained by the attacker. This can be harmful if it happens to your personal computer, but it can be absolutely devastating if an attacker is able to perform credential dumping on a computer that is a part of a larger network.
This hacking technique is implemented after a computer has been breached by the attacker. Usernames and passwords are extremely valuable to cybercriminals and can be used to acquire sensitive information as well as to gain access to admin and other privileged account credentials and other computers on a network.
After gaining access to a computer, a hacker will perform credential dumping by gaining access to the cache of passwords that are stored in your computer s memory. For user convenience, operating systems and browsers have the ability to save usernames and passwords and then automatically fill in your login information to sites and programs you frequent. Unfortunately, this convenience has come at a cost and can leave your information more vulnerable to credential theft and dumping.
Mimikatz
One of the most common tools used to perform credit dumping is Mimikatz. This piece of code was created by Benjamin Delphy in 2007 in order to demonstrate a flaw in the security system of Windows. His code was successful and convinced Windows to eventually fix the flaw, and Mimikatz continued to be used for penetration and security testing. Sadly, the good intentions of the Mimikatz code have been taken advantage of, and it is now a popular tool for hackers.
How to avoid credential dumping
- Limit and monitor the use of admin passwords.
- Limit credential reuse.
- Implement multi-factor authentication.
- Use a password manager with a strong, unsaved password.
- Implement strong hashing and encryption.
- Monitor NTLM, access control lists, and lsass.exe.
