Credential theft turns one stolen laptop into a full breach. In our conversation with the co-author of my book Learning Ransomware Response & Recovery, we learn from Dr. Mike Saylor how attackers harvest passwords and how to stop them.
A credit union employee had a logged-in laptop at a coffee shop, turned around, and it was gone. BitLocker didn’t help, because the machine was unlocked. The attackers harvested local credentials, figured out how the credit union’s business processes worked, and then phished other employees from the inside while posing as the person who lost the laptop.
We start with how attackers think. Their first move is reconnaissance: what do I have, what’s it worth, and how do I keep access before somebody wipes it? Mike explains why the victim has about 30 minutes to respond, why a fear-based culture makes that window worse, and why you need a documented stolen-laptop playbook before you need it.
Then we cover the stuff that makes credential theft so easy. Shared local admin passwords on every machine. Predictable new-user passwords with an exclamation point on the end (yes, really). Service accounts whose passwords never change. Default SNMP strings. Mike explains Kerberoasting in plain English and shares new research on how an unprotected printer can lead to a complete network takeover.
The back half is all about fixing it. LAPS or a similar tool for unique local admin passwords. Just-in-time credentials that expire on their own. Tiered administration. Separate user and admin accounts for every admin, so nobody checks Gmail with domain admin rights. Mike tells the story of a database admin who deleted something in production because her test and production credentials were the same.
We finish with alerting: what to alert on, why you’ll get a flood of false positives at first, and why my new freezer sensor proves the point.
If you manage credentials for anyone, this one’s worth your time.
⏱️ CHAPTERS
00:00 - Intro
01:49 - Welcome, Prasanna, and too many Reacher books
03:37 - Dr. Mike Saylor joins
04:07 - The stolen credit union laptop
05:42 - Reconnaissance and persistence: what attackers do first
08:31 - Privileged credentials that never change
10:36 - The 30-minute window after a stolen laptop
13:19 - Security culture and automated incident response
15:06 - Shared local admin passwords
17:23 - Predictable default passwords
18:20 - What attackers harvest: everything
19:01 - Kerberoasting explained
24:01 - Default credentials and the printer problem
25:22 - When the proof of concept becomes production
26:46 - The Brocade Silkworm story
28:07 - LAPS and just-in-time credentials
30:30 - Tiered administration and separate admin accounts
35:00 - Alerting on authentication events
36:10 - Expect false positives (and my freezer)
39:16 - Alert fatigue vs. alert annoyance
41:27 - Wrap-up
🎧 Listen to the episode: https://www.backupwrapup.com/how-to-prevent-credential-theft/
📘 Get the book, Learning Ransomware Response and Recovery: https://www.oreilly.com/library/view/learning-ransomware-response/9781098169572/
🛡️ See what Mike and I are building: https://www.stopransomware.com
💼 Backup, DR, and expert witness consulting: https://www.backupcentral.com
