exposure: ceo email passwords and pwnage · pdf fileceo email eposure: passwords and pwnage 2...
TRANSCRIPT
CEO EMAIL EXPOSURE:
PASSWORDS AND PWNAGE
2CEO EMAIL EXPOSURE: PASSWORDS AND PWNAGE
IntroductionPasswords have become the bane of our digital existence. We use so many different accounts and services that
attempting to keep track of them all is an intimidating feat. In the workplace, the situation is hardly simpler – to conduct
tasks and keep business moving, we’re obligated to sign in to various services.
Regular headlines announcing data breaches serve as reminders that these accounts are all too vulnerable. It’s safe to
assume that a fair number of services one is registered to have already been compromised – leaking our identities, user
credentials, and maybe even secrets.
F-Secure recently conducted a study of CEO emails to find out which breached services top executives are linking
with their company email address. We used known email addresses for over 200 CEOs at the largest companies in 10
countries, who had been employed by the same company in some capacity for at least five years. We then checked those
emails against our database of leaked credentials.
Among our findings:
Nearly one in three (30%) of CEOs have used their company
email address to register for a service that was later breached,
exposing their password and other details.
The most common breached services for CEOs to
link their company email with are LinkedIn and Dropbox.
81% of CEOs have had their email address and other personal
information exposed online in the form of spam lists or leaked
marketing databases.
Just 18% of CEOs have no leaks associated with their email address.
Our findings underscore the importance of using a unique, strong password for each online account. The passwords
hacked from these services are floating around on the internet, waiting to be wielded by attackers in targeting their
victims. Re-using a password to log in to a work-related account that has also been used for a breached service is a
scenario that could be potentially exploited by a motivated attacker.
Pwn (verb): To own or dominate an opponent; to compromise, control or illegally gain access to a device,
server or application.
LinkedIn Dropbox Adobe Myspace AstroPID Disqus Eroticy NetEase Other*
53 %
3 % 2 %12 %18
%
3 % 3 % 2 % 2 %
Breakdown of breached services CEOs link with their company email
CEO email exposure
* 1 % each: Ashley Madison, Boxee, Dodonew, Emodo, Forbes, GTA Gaming Leet, mSpy, Stratfor, VK, 000Webhost
30 %
81 %
18 %
Associated with breached service, password leaked
On leaked spam / marketing lists
No leakage found
3CEO EMAIL EXPOSURE: PASSWORDS AND PWNAGE
Overall results
Overall, 30% of CEOs have had their passwords exposed on breached sites. This percentage will obviously be higher
where adoption of online services is higher. One might expect CEOs of information technology companies, for example,
to adopt these services more readily. Our findings support this expectation – of tech CEOs, 63% are registered with
breached services.
The top breached service for CEOs to link their company email address with is, predictably, the professional networking
site LinkedIn, followed by Dropbox, Adobe and Myspace.
When considering these results we should also state the disclaimer that it is of course possible for someone to attempt to register on a website using someone else’s email address. Whether or not this information is stored in the service’s database, however, depends on whether or not the database stores unverified registrations (which is likely, since in order to verify an email address it must be stored somewhere).
Denmark Finland France Germany Italy Japan Netherlands Sweden UK USA
62 %
40 %
13 % 10 %
27 %
9 %
43 %
27 %
14 %
38 %
CEOs using breached services, by country
86%
65 %
91 %81 %
50 %45 %
95 %
77 %
95 % 95 %
CEO details leaked on spam and other lists, by country
Denmark Finland France Germany Italy Japan Netherlands Sweden UK USA
4CEO EMAIL EXPOSURE: PASSWORDS AND PWNAGE
Results by CountryOut of ten countries, the CEOs most likely to link their email to these breached services are in Denmark, at 62%, followed by the Netherlands at 43%. Those least likely are in Japan, at only 9%.
Aside from accounts on breached services, CEOs are highly likely to have their emails and other details such as physical addresses, birthdates and phone numbers exposed in the form of spam lists and leaked marketing databases. 81% have had their information leaked in this manner, with CEOs in the UK, USA, Netherlands and France topping the list. Italy and Japan had the lowest numbers of CEOs appearing on these lists.
14 %
35 %
4 %
19 %
41 %
55 %
5 % 5 % 5 %
23 %
CEO emails not associated with leaks, by country
Denmark Finland France Germany Italy Japan Netherlands Sweden UK USA
5CEO EMAIL EXPOSURE: PASSWORDS AND PWNAGE
Just 18% of CEO email addresses are not associated with any leak or hack. The greatest number in this category are in Japan, at 55%, and Italy, at 41%. Only 4% of CEOs in France have email addresses that are unassociated with any hack, and only 5% in the UK , the USA and the Netherlands.
6CEO EMAIL EXPOSURE: PASSWORDS AND PWNAGE
ConclusionsShould CEOs connect services such as LinkedIn and Dropbox to their company email address? F-Secure Chief Information Security Officer Erka Koivunen points out that from a security standpoint, there are legitimate reasons to do so, but only when one is using the service to represent the company in a spokesperson role or when the service is being used for business purposes.
Using a private email address that’s not known to a larger audience could be seen as a tactical advance in terms of the earliest stage of the cyber kill chain; namely, the reconnaissance, Koivunen says. Opportunistic attackers may skip targeting someone if they haven’t bothered to check against their private personas. But there are drawbacks in terms of defense in the later stages of the kill chain.
“When using a private email, a personal phone number or a home address to register for a service that the CEO uses to conduct official business, the CEO effectively denies the company’s IT, communications, IPR, legal, and security teams a chance to protect the credentials, monitor their misuse or attempts to compromise them and makes it nearly impossible to recover them later,” Koivunen says. “To an attacker, a CEO who uses private email to register for a service they use in an official capacity, spells a loner - someone who goes it alone and doesn’t bother to rely on his/her staff to provide protection.”
Should a CEO lose control over their LinkedIn and Twitter accounts due to compromise, for example, the attacker would immediately change the passwords and lock the CEO out of his or her own accounts.
“If the CEO has registered for those accounts using a private Gmail address, it may be difficult to try to convice LinkedIn, Twitter or Google that he or she really is the rightful owner of those accounts,” Koivunen says. “In contrast, if the CEO needs to reset their company e-mail password, they simply ask IT support to reset it.”
When exploited by a motivated attacker, these seemingly small details can become big stories, as evidenced by the hack of former US secretary of state Colin Powell’s Gmail account last year. The hack divulged Powell’s candid thoughts on a range of highly charged political issues and prominent people, making waves during the 2016 US presidential campaign. Researchers say the hack may have been caused by Powell’s use of the same password to protect his Gmail account that he used for his Dropbox account. The Dropbox list of 68 million accounts compromised in 2012 was made public in August 2016, just a few weeks before Powell’s emails were published online.
7CEO EMAIL EXPOSURE: PASSWORDS AND PWNAGE
Password advice from a white hat hackerTom Van de Wiele, Principal Security Consultant at F-Secure, is an expert at breaking into accounts in his work as an ethical hacker. Here are his tips for keeping your accounts safe:
Use a unique and strong password for each online account. Length always wins, and a minimum of 14 characters is recommended.
Don’t invent password logic that can be used against you. “Attackers are not psychic, but after ‘cappuccino16’ and ‘macchiato17’ as passwords, it doesn’t take an AI cluster to figure out the next one,” Van de Wiele says.
Use two-factor authentication if the service offers it, but avoid the use of SMS passcodes if you can. Offline authenticators or hardware-based tokens are always preferred.
Know the lockout or recovery scenario for each service you use, as this is the step an attacker will likely target. And don’t let the recovery of your accounts be dependent on knowing a pet’s name, alternative e-mail address or your first car. (The targeted attacker already knows these things about you.)
Be careful about using social login, a form of single sign-on (SSO) which lets you log into a third party service using credentials from a social media site (e.g., “log in with LinkedIn”). “SSO is great for certain scenarios, but not when you have a lot of online services for which you get email. One will be a phishing email and if you fall for it, the attacker will have your password for all your services that support SSO,” says Van de Wiele.
Use a password manager, preferably one for which only you (not the company behind it) know your master password. Be wary of cloud-based password managers that don’t require access to the device in order to log into them – these can be exploited remotely by attackers to gain access to all your passwords.