Credential pair

How it works

Logging in takes two pieces of information: an identifier and a secret. When a service is breached, those two pieces are often stolen together. The resulting pair is simple to store, copy and test. OWASP describes credential stuffing as the automated injection of stolen username and password pairs into login forms to gain access to accounts.

The pair may hold the password in plaintext, or as a hash that an attacker later cracks. Either way, once a working pair exists it can be tried on other services in bulk.

How it shows up in executive exposure

Pairs are what most leaked credential data is made of. They appear inside breach corpora, in combolists that strip away everything else, and in stealer logs that add the website where the pair was entered. An executive with a pair in any of these has a password that someone else holds. If that password also protects email, banking or a corporate single sign-on page, the pair is a direct path in.

Context matters more than the number of pairs. One recent pair for a business email address is worse than many old pairs for forgotten accounts. WebThreat's CEM looks at exposed records and data types, and an exposed password moves a leader up the list of what to fix first, as the methodology explains. The findings reflect what breach corpora and leak databases hold about each person, which is the pair an attacker already has.

How to reduce the risk

• Reset any password that was part of an exposed pair.
• Use a different password for every account, with a password manager.
• Turn on multi-factor authentication. OWASP calls it by far the best defense against most password-related attacks, including credential stuffing.
• Check new passwords against known-compromised lists when you build or run a login system.

How it differs from related terms

A credential pair is one record. A combolist is a long list of them. A ULP list adds the site address to each pair. A stealer log holds pairs plus device data captured from an infected machine. For how pairs are used, see credential stuffing. The article on what to do when an executive's password is in a breach covers the response.