Lifting the Curse of Static Credentials

Summary: Use digital identities, trust relationship and access control lists instead of passwords. In the cloud, this is really easy.

I strongly believe that static credentials are one of the biggest hazards in modern IT environments. Most information security incidents are somehow related to lost or leaked or guessed static credentials, Instagram's Million Dollar Bug is just one very nice example. Static credentials

• can be used by anyone who has them - friend or foe
• are typically very short and can even be brute forced or guessed
• for machine or service users have to be stored in configuration files from where they can be leaked
• are hard to remember for humans so that they will write them down somewhere or store them in files
• typically stay the same over a long period of time
• don't include any information about the identity of the bearer or user
• are hard to rotate on a regular base because the change has to happen in several places at the same time

All those problems disappear if we use digital identities and trust relationships instead of static credentials. Unfortunately static credentials are incredibly easy to use which makes them hard to eradicate.

Update: In May 2024 I gave a talk about this (Video, Slides):

Static credentials are from the medieval ages

Source: Dr. Pepper ad from 1963 / Johnny Hart

Back in time passwords or watchwords where state of the art. For example membership in a secret club or belonging to a certain town could be proven with a "secret" password. Improvements where "password of the day" (nice for watchtower situations) or even "challenge response" methods like completing a secret poem or providing a specific answer to a common question.

Basically everything we do with static credentials, for example a website login, follows exactly those early patterns. Even though the real world has moved on to identity based access control in the 19th and 20th century. Passports and ID cards certify the identity of the bearer and the border control checks if the passport is valid, if the person presents his/her own passport and decides if the person is allowed passage. Nobody would even think about granting access to anything in the real world in exchange for just a password.

So why is IT security stuck in the medieval ages? IMHO convenience and lack of simple and wide spread standards. We see static credentials almost everywhere in our daily business:

• Website logins - who does not use a password manager? Only very few websites manage without passwords
• Database credentials - are probably the least rotated credentials of all
• Work account login - your phone stores that for you
• SSH keys - key pass-phrases don't add much security, SSH key security is much underestimated
• ...

Sadly, agreeing upon static credentials and manually managing them is still the only universally applicable, compatible and standardized method of access protection that we know in IT.

Modern IT

Luckily in professional environments there is a way out. In a fully controlled environment there should be no need for static credentials. Every user and every machine can be equipped with a digital identity whose static parts are stored in secure hardware storage (e.g. YubiKey and TPM). Beyond that all communication and access can be granted based on those digital identities. Temporary grants by a granting authority and access control lists give access to resources. The same identity can be used everywhere thereby eliminating the need for static credentials.

Kerberos and TLS certificates are well known and established implementations of such concepts. Sadly many popular software solutions still don't support them or make their use unnecessary complicated. As the need to use certain software typically wins over the wish to have tight security we users end up dealing with lots of static credentials. The security risk is deemed acceptable as those systems are mostly accessible from inside only. Instagram's Million Dollar Bug of course proves the folly of this thought. A chain of static AWS credentials found in various configuration files allowed exploiting everything:

Source: Instagram's Million Dollar Bug (Internet Archive) / Wesley

Facebook obviously did not think about the fact that static AWS credentials can be used by everyone from everywhere.

The Cloud Challenge

As we move more and more IT functions into the Cloud the problem of static credentials gains a new dimension: Most of our resources and services are "out there somewhere" and not part of our internal network. There is absolutely no additional layer of security! Anybody who has the static credential can use them and you won't even notice it.

Luckily Cloud providers like Amazon Web Services (AWS) also have a solution for that problem: AWS Identity and Access Management (IAM) provides the security backbone for all communication between machines and users one one side and Amazon APIs on the other hand. Any code that runs on AWS is assigned a digital identity (EC2 Instance Role, Lambda Execution Role) which provides temporary credentials via the EC2 instance metadata interface. Those credentials are then used to authenticate API calls to AWS APIs.

As a result it is possible to run an entire data center on AWS without the need for static credentials for internal communication. Attackers who gain internal access will not be able to access more resources than the exploited service had access to. Eradicating internal static credentials would therefore have prevented Instagram's Million Dollar Bug.

Avoid Static Credentials

In a world of automation static credentials are often a nuisance. They have to be added to all kind of configuration files while protecting them from as many eyes as possible. In the end, many secrets management solutions only protect the secrets from the admins and casual observers but do not prevent leaked secrets in general. Identity-based security actually helps in automated environments. The problem of static credentials is reduced to just one set for the digital identity. All other communication just uses that identity for authentication.

Eradicating static credentials and using digital identities not only significantly improves security but also assists in automating everything.

If you use AWS, start today to replace static AWS credentials by IAM roles. Use the AWS Federation Proxy to provide IAM roles to containers and on-premise servers in order to remove static AWS credentials from both your public and your private cloud environments.

For your local environment, use Kerberos pass-through authentication instead of service passwords.

For websites try to use federated logins (e.g. OpenID Connect) and favor those that don't need a password.

For your own stuff, be sure to enable 2 factor authentication and store certificates and private keys in hardware tokens like YubiKey.

The next articles in this series are Eliminating the Password of Shared Accounts and A Login Security Architecture Without Passwords.