Traditional identity theft involves criminals stealing personal information to impersonate real individuals. However, synthetic identity fraud presents a more insidious challenge. In this scheme, attackers create entirely new identities by combining real and fabricated data, resulting in personas that don’t correspond to actual people. These synthetic identities can accumulate permissions and credibility over time without detection, as there’s no real victim monitoring their misuse.
This concept extends beyond human identities to Non-Human Identities (NHIs), such as service accounts, application credentials, and machine certificates. Security teams often focus on protecting existing NHIs from being compromised but may overlook the risk of fabricated machine identities. Instead of hijacking an existing service account, attackers can create a new one that appears legitimate by blending real environmental attributes with fake ones. In environments with weak governance and rapid accumulation of NHIs, these fabricated identities can easily go unnoticed.
Mechanisms of Fabricated Machine Identities
Attackers employ several methods to create convincing machine identities:
- Rogue Service Accounts: An attacker with access to a system creates a new service account that mimics existing ones, adopting similar attributes and permissions. This unsanctioned account operates like a legitimate one, making it difficult to detect.
- DCShadow Attacks: In this advanced technique, an attacker with domain administrator rights registers a rogue domain controller. This allows them to replicate malicious changes across the network, appearing as legitimate replication traffic from a trusted source.
- Shadow Credentials: Attackers implant unauthorized authentication mechanisms onto existing accounts, enabling them to impersonate legitimate NHIs without altering the original credentials.
Implications and Mitigation Strategies
The rise of synthetic identity fraud targeting machine identities underscores the need for robust identity governance and management practices. Organizations should implement stringent controls to monitor the creation and usage of NHIs, ensuring that only authorized identities exist within their systems. Regular audits, anomaly detection, and the principle of least privilege can help mitigate the risks associated with fabricated machine identities.
As cyber threats evolve, understanding and addressing the nuances of synthetic identity fraud in both human and machine contexts is crucial. Proactive measures and continuous vigilance are essential to safeguard organizational assets from these sophisticated attacks.
