Detecting use of compromised security credentials in private enterprise networks

1. A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

obtaining, with one or more processors of a private computer network, a set of user-authentication credentials comprising a first user identification and a first password;

querying, with one or more processors, a distributed credential-monitoring application with a query requesting compromised credentials corresponding to the first user identification, wherein the distributed credential-monitoring application is external to the private computer network;

receiving, with one or more processors, query results including one or more passwords associated with the first user identification;

determining, with one or more processors, with a credential guardian module, that at least some of the one or more passwords in the query results match the obtained first password, wherein the credential guardian module is within the private computer network; and

in response to the determination, blocking, with one or more processors access to a first user account of a first user on the private computer network associated with the set of user-authentication credentials.

2. The medium of claim 1 , wherein:

the distributed credential-monitoring application is queried in response to a user attempting to log in using the first user identification; and

the received one or more passwords is a plaintext password.

3. The medium of claim 1 , wherein:

the distributed credential-monitoring application comprises:

a remote credential-monitoring application external to the private computer network; and

the credential guardian module within the private computer network;

the remote credential-monitoring application is configured to ingest and validate collections of compromised credentials and expose an application program interface by which the collections of compromised credentials are interrogated by the credential guardian module; and

the credential guardian module is configured to determine that the at least some of the one or more passwords in the query results match the obtained first password and, in response to the determination, instruct a domain controller to change a value in the first user account to designate the obtained first password as inoperative.

4. The medium of claim 1 , wherein:

the query results include one or more passwords associated with different user identifications determined to correspond to the obtained first user identification.

5. The medium of claim 1 , wherein:

the operations comprise determining that the first user account associated with the first user identification is an active user account; and

determining that the at least some of the one or more passwords match the first password associated with the first user identification is performed in response to determining that the first user account associated with the first user identification is the active user account.

6. The medium of claim 5 , wherein determining that the first user account associated with the first user identification is the active user account comprises:

retrieving, from a database, a time stamp of a previous access of the first user account; and

determining that the first user account is the active user account based on a time difference between the time stamp and a current time being less than a threshold duration.

7. The medium of claim 1 , wherein the operations comprise:

determining, before the query, that one or more of the received one or more passwords is a non-plaintext password; and

cracking the non-plaintext password.

8. The medium of claim 1 , wherein the operations comprise:

determining that the first user account is being accessed after determining that the one or more passwords match the obtained first password associated with the first user identification; and

in response to determining that the first user account is being accessed, causing the first user account to be logged off.

9. The medium of claim 1 , wherein the operations comprise:

determining an amount of times the first user of the first user account has been notified to change passwords associated with the first user identification;

determining that the amount exceeds a threshold; and

in response to determining that the amount exceeds a threshold, increasing an amount of different types of credentials required by a domain controller included in the private computer network to access the first user account associated with the first user identification.

10. The medium of claim 1 , wherein the operations comprise:

obtaining a second user identification and a second password associated with a second user; and

determining that the second user identification or the second password do not appear in a set of compromised credentials.

11. The medium of claim 10 , wherein:

the set of compromised credentials comprise more than 100 million compromised credentials; and

determining that the second user identification or the second password do not appear in the set of compromised credentials is performed within 5 seconds of obtaining the second user identification and the second password.

12. The medium of claim 11 , wherein:

the second user identification or the second password is determined to not appear in the set of compromised credentials based on a probabilistic data structure to which data describing the set of compromised credentials is written.

13. The medium of claim 11 , wherein:

the second user identification or the second password is determined to not appear in the set of compromised credentials based on a content-addressable data structure to which data describing the set of compromised credentials is written.

14. The medium of claim 11 , wherein:

a timestamped ciphertext based on a secret key is sent to a user computing device submitting the second user identification and the second password after determining that the second user identification or the second password do not appear in the set of compromised credentials;

the user computing device is configured to obtain, based on the timestamped ciphertext, session credentials by which the private computer network permits the user computing device to access resources on another computing device on the private computer network.

15. The medium of claim 14 , wherein:

the timestamped ciphertext expires and renewal is automatically requested; and

automatic renewal is prevented in response to determining that the second user identification and the second password have been added to the set of compromised credentials.

16. The medium of claim 1 , wherein:

the match is based on a cryptographic hash collision.

17. The medium of claim 1 , wherein the operations comprise:

steps for preventing account access by a malicious actor; and

steps for expediting determining a union of two sets.

18. The medium of claim 1 , wherein the operations further comprise:

in response to the determination, causing, with one or more processors, a first user associated with the first user account to be notified to reset the obtained first password.

19. A method, comprising:

obtaining, with one or more processors of a private computer network, a set of user-authentication credentials comprising a first user identification and a first password;

querying, with one or more processors, a distributed credential-monitoring application with a query requesting compromised credentials corresponding to the first user identification, wherein the distributed credential-monitoring application is external to the private computer network;

receiving, with one or more processors, query results including one or more passwords associated with the first user identification;

determining, with one or more processors, with a credential guardian module, that at least some of the one or more passwords in the query results match the obtained first password, wherein the credential guardian module is within the private computer network; and

in response to the determination, blocking, with one or more processors access to a first user account on the private computer network associated with the set of user-authentication credentials.

20. A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

receiving, with one or more processors at a distributed credential-monitoring application from a domain controller of a private computer network, a query requesting compromised credentials corresponding to a set of user-authentication credentials comprising a first user identification and a first password, wherein the distributed credential-monitoring application is external to the private computer network;

retrieving, with one or more processors via an application programming interface, from a database, one or more passwords associated with one or more first user identification entries in the database that matches the first user identification; and

providing, with one or more processors, query results including one or more passwords associated with the first user identification, wherein the query results cause a credential guardian module that is within the private computer network to determine that at least some of the one or more passwords in the query results match the first password, and in response, block, with the domain controller, access to a first user account on the private computer network associated with the first user identification and the first password.