Are Default Passwords Hiding in Your Active Directory? Here's how to check

One of the biggest cybersecurity mistakes that an organization can make is failing to change a default password. Consider for example, what might happen if a home user were to fail to change the default password on their Wi-Fi router.

A cybercriminal could perform a simple Web search to determine the router manufacturer’s default password and then log into the router. From there, the criminal could conceivably change the router’s password, effectively locking its owner out.

The problem, as this example illustrates, is that default passwords are well documented and easy to exploit, both in the home and in the enterprise. In fact, many password spraying attacks specifically target default passwords.

Atlassian has a product called Confluence that functions as a remotely accessible collaborative workspace. Besides the main Confluence app, the company also makes a supporting app called Questions for Confluence. This app, which has been downloaded thousands of times, automatically creates a default username and password that is used to facilitate customer data migration from the application to the Confluence Cloud.

Unfortunately, someone was able to figure out the default username and password that was hardcoded into the app and leaked the cracked credentials online. An attacker who knows these credentials can take full control over any non-restricted page within Confluence.

Worse still, uninstalling the Questions for Confluence app does not fix the problem because the credentials remain in place even after the app has been removed.

Atlassian has released a patch that will help to secure vulnerable systems, but is also asking affected customers to remove or disable the account named disabledsystemuser.

Even though this particular incident was specific to Atlassian, it underscores the dangers posed by default passwords.

Are default passwords inevitable?

Unfortunately, default passwords can be tough to avoid. Every organization uses them in at least some capacity. Think about your own organization and the process that you currently have in place for creating new user accounts. Chances are that those accounts are initially assigned a default password that must be changed the first time that a user logs in.

The problem with this is that there may be accounts lurking within your Active Directory that were created, but never used. Imagine what might happen if a new employee was hired, but failed to show up (a relatively common occurrence). An account might have already been created for the employee, and unless the organization has a policy in place for removing the account, it might exist indefinitely - with a default password.

Tracking down irrelevant default passwords

The question is, how can you track down default passwords on your network once they’re no longer useful? One of the best options is to use a free, read-only tool called Specops Password Auditor.

Although this tool does not crack passwords, it can tell you who among your users are using duplicate passwords. That being the case, you could create a new account with a default password and then run a report to find out if any other accounts are using the same password as the account that you just created (i.e. the default).

Incidentally, this report is also good for finding service accounts that are using identical passwords or admins who use the same password for both their privileged and unprivileged accounts.

It is worth noting that Specops Password Auditor can do much more than just checking for default passwords. You can also use it to locate users who have not changed their passwords for an extended period of time (which may indicate that the account has been abandoned).

Likewise, you can check for things like expired passwords, blank passwords, or passwords that are known to have been compromised.

Prevent the use of 3rd party default passwords in your Active Directory

The other thing that you should be doing is to make sure that no vendor default passwords exist within your Active Directory environments. One of the best options for preventing such passwords is to use Specops Password Policy, which allows you to create a custom list of banned passwords.

You can then populate this list with the passwords that hardware and software vendors use by default. That way, if anyone tries to use one of these default passwords, they will be prevented from doing so since they’re such a security vulnerability.

You can test out Specops Password Policy in your Active Directory for free, anytime.

Sponsored by Specops