How Synthetic Identity Fraud is Coming for Machine Identities 合成身份欺诈如何威胁机器身份

TL;DR

• Synthetic identity fraud is emerging as a critical threat to Non-Human Identities (NHIs), where attackers fabricate service accounts rather than stealing existing ones.
• These fabricated identities blend real environmental attributes with fake data, allowing them to evade detection by mimicking legitimate workloads and accumulating permissions silently.
• Agentic AI exacerbates this risk by automating identity creation at runtime, blurring the line between legitimate provisioning and malicious fabrication.
• Traditional security models focused on stolen credentials are insufficient; defense requires strong governance and automated monitoring to identify illegitimate machine identities.

Why It Matters

This shift from credential theft to identity fabrication represents a fundamental change in attack vectors, making traditional anomaly detection based on compromised user alerts ineffective. As enterprises rapidly expand their NHI footprints, the lack of human ownership for these identities creates blind spots that attackers can exploit to establish persistent, high-privilege access without triggering standard security alarms.

Technical Details

• Fabrication Techniques: Attackers use methods such as creating rogue service accounts with plausible naming conventions, employing DCShadow to register rogue domain controllers for trusted replication, or implanting shadow credentials onto existing objects to forge authentication material.
• Stealth Mechanisms: Unlike stolen identities, fabricated NHIs have no owner to detect misuse. They inherit environment-specific metadata, naming structures, and permission requests, allowing them to blend into directories containing tens of thousands of service accounts.
• Agentic AI Impact: The rise of agentic AI allows for dynamic, automated credential acquisition and the spontaneous generation of new agent identities, reducing the manual friction previously required to create and maintain synthetic machine identities.
• Governance Gap: Current security efforts predominantly focus on protecting existing NHIs from hijacking, leaving a significant gap in detecting identities that were never legitimately provisioned in the first place.

Industry Insight

Security teams must transition from monitoring only for compromised credentials to implementing robust governance frameworks that validate the legitimacy of every NHI at the point of creation. Organizations should prioritize automated discovery and continuous auditing of machine identities to detect anomalies in naming patterns, privilege accumulation, and behavioral metadata that indicate synthetic fabrication.

TL;DR

• 提出“合成身份欺诈”在非人类身份（NHI）领域的概念，即攻击者伪造而非窃取机器身份，使其混入合法服务账户中。
• 此类欺诈利用真实环境与虚构属性的混合，规避传统针对凭证泄露或异常行为的检测机制，因无人类所有者监控而极难发现。
• 介绍了三种主要构建手段：伪造服务账户、DCShadow（注册流氓域控制器）及阴影凭据（植入伪造认证）。
• Agentic AI 的兴起加剧了风险，自动化代理动态创建身份的能力模糊了合法与伪造身份的界限，降低了攻击门槛。
• 防御核心在于强化治理与自动化监控，通过严格的生命周期管理和所有权归属来防止未授权身份积累权限。

为什么值得看

这篇文章揭示了网络安全中一个日益严峻但常被忽视的盲区：非人类身份（NHI）的合成欺诈。随着企业环境中机器身份数量激增且超过人工管理负荷，传统的基于“被盗凭证”的检测模型已失效，从业者需重新审视身份治理策略以应对这种隐蔽性更强的威胁。

技术解析

• 概念定义：合成机器身份并非劫持现有账户，而是创建从未被授权存在的身份。它通过模仿环境的命名约定、域名和元数据，伪装成常规工作负载，从而在管理员审查成千上万个服务账户时隐身。
• 攻击手法：
  • Rogue service account：攻击者获取访问权后，创建具有相似属性和静态访问权限的新账户，绕过对现有账户的监控。
  • DCShadow：在基础设施层面，攻击者注册流氓域控制器，使恶意更改看起来像来自可信对等体的合法复制流量，从而赋予伪造身份系统级信誉。
  • Shadow credentials：在现有对象上植入攻击者控制的认证材料，实现静默伪造，这是最隐蔽的手段之一。
• AI 加剧因素：Agentic AI 允许代理在运行时动态获取凭据并自动启动其他带有自身身份的代理。这种自动化使得身份创建成为后台活动，导致合法身份与伪造身份的界限模糊，增加了检测和区分的难度。
• 检测难点：由于没有真实受害者监控滥用行为，且缺乏人类所有者的警报（如陌生地点登录），合成身份可以悄无声息地积累权限，直到造成重大损害。

行业启示

• 从“防窃”转向“防造”：安全团队需调整重心，不再仅关注凭证泄露防护，而应建立针对身份生命周期完整性和来源验证的治理框架，确保每个 NHI 都有明确的合法来源和人类所有者。
• 自动化治理不可或缺：面对指数级增长的机器身份，手动审计已不可行。必须部署自动化身份治理工具，实时监控身份创建事件，识别并阻断未经授权的合成身份生成。
• 警惕 AI 代理的安全边界：在引入 Agentic AI 时，必须实施严格的沙箱策略和最小权限原则，限制代理自主创建新身份或提升权限的能力，防止自动化过程被用于大规模部署合成欺诈身份。