US 9,871,797 B2Granted

Information security apparatus and methods for credential dump authenticity verification

AssigneeLookingglass Cyber Solutions, Inc.

InventorsSteven Weinstein, Jason Lewis, Douglas Parker

Life of this patent

Estimating the term…

Loading patent…

Abstract

In some embodiments, an apparatus includes a memory, storing processor-executable instructions, blacklist terms, and credential dump records, and a processor. The processor receives repository data from targeted remote repositories and stores the repository data as a potential credential dump in the memory when the repository data includes a credential dump attribute. The processor stores the potential credential dump as a probable credential dump when the potential credential dump does not include a blacklist term, in which case the processor also detects a format and delimiter of the probable credential dump. Based on the format and delimiter, pairs of usernames and associated passwords are identified and hashed. If a percentage of the hashes not associated with the credential dump records exceeds a predetermined threshold, the probable credential dump is deemed authentic.

Claims21

Dependent claims

An apparatus, comprising:

a memory storing processor-executable instructions, a plurality of blacklist terms associated with an instruction to ignore data, and a plurality of credential dump records, each credential dump record from the plurality of credential dump records including an associated plurality of hashes;
and
at least one processor, operably coupled to the memory and configured to execute the processor-executable instructions to:
receive repository data from a plurality of targeted remote repositories;
in response to a determination that a credential dump attribute is identified in the repository data:
access each blacklist term from the plurality of blacklist terms that are previously-identified and stored;
determine whether a blacklist term from the plurality of blacklist terms is identified in the repository data;
and
in response to a determination that a blacklist term from the plurality of blacklist terms is not identified in the repository data:
detect a common format and a common delimiter of the repository data;
identify a plurality of pairs of usernames and associated passwords of the repository data based on the common format and the common delimiter;
generate a hash for each pair of usernames and associated passwords from the plurality of pairs of usernames and associated passwords to produce a plurality of hashes;
compare the plurality of hashes to the plurality of credential dump records stored in the memory;
determine a percentage of the plurality of hashes that are not associated with the plurality of credential dump records;
send a signal indicating that the repository data is an authentic credential dump in response to the determination that the percentage is larger than a predetermined threshold;
identify an intrusion into a computer system associated with the repository data in response to the determination that the percentage is larger than the predetermined threshold;
and
the credential dump attribute including at least one of:
the repository data including more than a predetermined number of usernames and the repository data including a password-type field.

16 more elements

A method, comprising:

receiving, using a processor, remote source data from a plurality of targeted remote sources;
in response to a determination that a credential dump attribute is identified in the remote source data:
accessing each blacklist term from the plurality of blacklist terms that are previously-identified and stored;
and
determining whether a blacklist term from the plurality of blacklist terms is identified in the remote source data;
in response to a determination that a blacklist term from the plurality of blacklist terms is not identified in the remote source data:
storing (1) a plurality of credential pairs of the remote source data and (2) metadata associated with the plurality of credential pairs in a memory that is operably coupled to the processor;
detecting a format of the remote source data including identifying a plurality of usernames and the plurality of passwords;
normalizing, using, the processor, the plurality of credential pairs into a concatenated, delimiter-free format, the normalizing is based on the plurality of usernames and the plurality of passwords;
converting, using the processor, the normalized plurality of credential pairs into a plurality of hashes;
comparing, using the processor, the plurality of hashes to previously-collected credential dump data to determine a percentage of the plurality of hashes that are not included in the previously-collected credential dump data;
sending, using the processor, a signal indicating, that the remote source data includes an authentic credential dump in response to the determination that the percentage of the plurality of hashes that are not included in the previously-collected credential dump data is larger than a predetermined threshold;
and
identifying an intrusion into a computer system associated with the remote source data in response to the determination that the percentage of the plurality of hashes that are not included in the previously-collected credential dump data is larger than the predetermined threshold.

11 more elements

A method, comprising:

storing a plurality of blacklist terms associated with an instruction to ignore data, and a plurality of credential dump records;
receiving, using a processor, remote source data from a plurality of targeted remote sources;
in response to a determination that a credential dump attribute is identified in the remote source data:
accessing each blacklist term from the plurality of blacklist terms that are previously-identified and stored;
and
determining whether a blacklist term from the plurality of blacklist terms is identified in the repository data;
in response to a determination that a blacklist term from the plurality of blacklist terms is not identified in the remote source data:
storing (1) a plurality of credential pairs of the remote source data, each credential pair of the plurality of credential pairs including an associated username and an associated password, and (2) metadata associated with the plurality of credential pairs, in a memory that is operably coupled to the processor;
comparing, using the processor, the plurality of credential pairs to previously-collected credential dump data to determine a percentage of the plurality of credential pairs that are not included in the previously-collected credential dump data;
sending, using the processor, a signal indicating that the remote source data includes an authentic credential dump in response to the determination that the percentage of the plurality of credential pairs that are not included in the previously-collected credential dump data is larger than a predetermined threshold;
identifying, using the processor, an intrusion into a computer system associated with the remote source data in response to the determination that the percentage of the plurality of credential pairs that are not included in the previously-collected credential dump data is larger than the predetermined threshold;
and
the credential dump attribute including at least one of:
the repository data including more than a predetermined number of usernames and the repository data including a password-type field.

11 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/019,259Filed 9 Feb 2016
Published: US 2017/0230372 A110 Aug 2017
Granted: 16 Jan 2018
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

H04L 63/101
For controlling access to devices or network resources: access control lists [ACL]
G06F 16/9014
Indexing; Data structures therefor; Storage structures: hash tables
G06F 17/00
Digital computing or data processing equipment or methods, specially adapted for specific
G06F 21/00
Security arrangements for protecting computers, components thereof, programs or data against unauthorised