Log In Through the Front Door: Automating Defense Against Credential Attacks

Log In Through the Front Door: Automating Defense Against Credential Attacks

Speaker: Barath Subramaniam

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: https://www.youtube.com/watch?v=C6H9FLYwAEc

Reading time: ~7 minutes

TL;DR

Attackers increasingly bypass technical defenses entirely by using stolen credentials to simply log in as legitimate users — a technique implicated in one out of every three breaches. Barath Subramaniam, Senior Product Security Engineer at Adobe, outlines a two-phase framework for building an automated credential monitoring program, walking through the threat landscape, data sources, detection pipelines, and remediation workflows that security teams can deploy today.

Introduction

"Attackers aren't breaking in — they're logging in." That opening statement from Subramaniam isn't hyperbole. The Google Mandiant M-Trends 2024 report ranks stolen credentials fourth among initial infection vectors, while the Verizon 2025 Data Breach Investigation Report places them third, accounting for roughly one in every three breaches. The CrowdStrike 2025 Global Threat Report goes further, attributing valid account abuse to 35% of all cloud incidents.

Despite these numbers, a Constella Intelligence survey of executives found that nearly half admitted they don't actively monitor for leaked credentials — even organizations that have already suffered breaches caused by exactly that vector. Subramaniam's talk addresses this gap head-on: not with more perimeter tools, but with a systematic, automated program that finds leaked credentials before attackers can act on them.

The Threat Landscape: Combo Lists and Stealer Logs

▶ Watch: Credential threat categories explained (08:03)

The more than 25 billion stolen credentials circulating on the dark web today fall into two primary categories. The first is combo lists — curated dumps aggregated from historical third-party breaches such as LinkedIn, compiled into structured, deduplicated sets. Subramaniam cited several well-known collections: the 2016 AntiPublic dump (the first large-scale credential dump), Collections 1–5, and the 2021 Compilation of Many Breaches (COMB), which contained 3.2 billion credentials. Combo lists typically include email/username and password pairs, and sometimes URL combos that identify the specific site where a victim's credentials were captured.

The second category is more dangerous in real time: stealer logs generated by info-stealer malware families such as Lumma Stealer and RedLine Stealer. Unlike static combo lists, stealer logs are harvested fresh from infected machines and distributed immediately through Telegram channels, Discord servers, and dedicated C2 infrastructure — sometimes within minutes of infection. These logs contain not just credentials but full browsing session data, cookies, autofill data, and system fingerprints. Subramaniam noted that the malware-as-a-service ecosystem — with subscriptions priced as low as $250 per month — has democratized this attack capability, enabling even low-skilled threat actors to harvest and monetize credentials at scale. Crucially, stealer tooling has expanded beyond Windows to target macOS and other platforms.

Case Studies: Where Credential Monitoring Would Have Mattered

▶ Watch: Colonial Pipeline and Uber breach analysis (02:00)

Subramaniam grounded the talk in three high-profile breaches, each of which a functioning credential monitoring program could have mitigated or prevented.

Colonial Pipeline — The credential used to access the VPN had already appeared in a previous data breach. No active dark web monitoring was in place to catch it. The resulting ransomware attack caused fuel supply disruption across the US East Coast.

Uber (2022) — Attackers obtained a contractor's credentials from the dark web, then bombarded the contractor with MFA push requests until frustration caused the contractor to approve one — a technique known as MFA fatigue. The attacker gained access to Uber's internal Slack and publicly bragged about the breach. The lesson: dark web monitoring combined with MFA-resistant authentication methods is essential, and security policies must apply uniformly to contractors and third-party vendors.

A 2024 incident (described without naming the company) — A former employee's account credentials appeared on the dark web. Because the account had not been deactivated after the employee's departure, the credentials were still valid. This underscored the importance of promptly disabling inactive accounts as part of offboarding.

Building the Program: A Two-Phase Architecture

▶ Watch: Combo list pipeline architecture (16:04)

Subramaniam proposes a staged approach, explicitly designed to build leadership buy-in before committing to premium tooling.

Phase 1 — Combo list integration (proof of value). Organizations can begin by ingesting publicly available or commercially sourced combo lists — often exceeding 15 terabytes of data — into blob storage. At Adobe, the team used Azure Databricks with Auto Loader (a change data capture technology) to ingest files in CSV, TXT, or JSON format into Delta tables. A matching job then checks the ingested credentials against Active Directory (for employees) and user databases (for customers), triggering forced password resets and MFA enrollment for any matches found. This phase is low-cost relative to its impact and demonstrates measurable value to leadership without requiring a commercial dark web vendor.

Phase 2 — Vendor/premium integration for stealer logs. Once the program has executive support, organizations should engage a commercial dark web intelligence vendor to access near-real-time stealer log feeds. Subramaniam stressed that not all vendors are created equal: the key differentiators are speed of data delivery (a two-day lag gives attackers a two-day window), breadth of dark web coverage across Telegram and Discord channels, and clarity/deduplication of the data provided. The architecture follows the same matching pattern, but pulling vendor feeds every 5–15 minutes rather than in large batch imports.

Remediation Workflow: Assume Breach, Act Accordingly

▶ Watch: Remediation decision tree walkthrough (20:05)

When a credential match is found, Subramaniam outlined a nuanced decision tree. The first question is whether the matched credential belongs to a current employee or a former one. Former employees should not be ignored — inactive accounts are a persistent risk, as the 2024 case study demonstrated.

For current employees, the workflow checks whether the password is present, then whether it is in cleartext or hashed, then whether it meets current complexity rules. If a match passes all these checks, the "happy path" triggers: a forced password reset, a global session logout (to invalidate all active cookies and prevent session hijacking), MFA enforcement, and a notification email to the employee and their manager.

Subramaniam flagged a counterintuitive scenario: if the found password doesn't validate against the current hash — suggesting the user recently changed it — the record should still be treated as a credential of interest rather than dismissed. "Assume breach. Investigate," he said, noting that many organizations treat these as routine hygiene events when they warrant full incident response treatment.

The program should also extend monitoring to customers, not just employees. Protecting customer credentials has both direct security benefits and indirect business value, and the same matching infrastructure can serve both populations.

Notable Quotes

"They are just logging in like your normal employees — no alerts, just access."

— ▶ 00:00

"Low volume is not equal to low value. It's still actually a sign of strength. Consider this to be a credential health insurance — keep scanning. No findings today does not mean no threats tomorrow."

— ▶ 26:05

"It's important to assume this as a breach. A lot of organizations consider this to be a normal process, but once you find a match, it's always critical you assume this to be a breach."

— ▶ 22:05

Key Takeaways

• Start with what's free. Billions of historical breach credentials are available through reputable sources. Building a combo list ingestion pipeline is an accessible first step that demonstrates value without large vendor spend.
• Stealer logs are the real-time threat. Unlike static combo lists, info-stealer logs are produced continuously and can be distributed within minutes of infection. Phase 2 of any credential monitoring program must address this vector.
• Monitor broadly. Employees are the primary focus, but customer credentials expose organizations to both direct security incidents and regulatory liability. The same infrastructure serves both.
• Speed matters in vendor selection. A two-day delay in credential feeds is a two-day attack window. Evaluate vendors on data freshness, dark web coverage breadth, and deduplication quality — not just price.
• Every match is a breach until proven otherwise. Even invalid or changed passwords should trigger investigation. Session cookies must be globally invalidated alongside password resets to prevent session hijacking from already-exfiltrated cookies.