Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

7/11/2018
11:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Major International Airport System Access Sold for $10 on Dark Web

Researchers from the McAfee Advanced Threat Research team began with an open search on Russian RDP shop UAS to make their discovery.

Dark Web marketplaces are troves of illicit products and data: stolen credentials, credit card numbers, and, as researchers recently discovered, remote desktop protocol (RDP) access to the security and building automation systems of a major international airport – for the cheap price of $10.

Researchers from the McAfee Advanced Threat Research team used an open search on Ultimate Anonymity Service (UAS), a Russian RDP shop, to search for open RDP ports at that specific organization. They narrowed their search from 65,536 possible IPs to three; by obtaining a complete IP address, they could look up the WHOIS data and find all addresses belonging to a major airport, the name of which is being withheld.

RDP is a proprietary protocol developed by Microsoft to let someone access another machine via graphical interface. It's intended for use by system admins but can be dangerous when attackers use it as an entry point. The recent SamSam ransomware campaign against American businesses is one recent example in which attackers spent $10 for access to a machine and demanded $40,000 in ransom. The actors behind SamSam continue to advance and spread the attack.

RDP shops serve as the foundation for major cyberattacks, reports McAfee, whose researchers scanned several RDP shops selling anywhere between 15 to more than 40,000 connections, the latter of which they discovered at UAS, the largest shop in their research.

RDP access provides a route to target systems without phishing, malware, or an exploit kit. Top use cases for RDP access include spam campaigns, cryptomining, ransomware, planting false flags to disguise illegal activity as coming from a victim's machine, and pilfering system data for identity theft, credit card fraud, account takeover, extortion, and other malicious use cases.

"It's a useful protocol," says McAfee chief scientist Raj Samani, pointing to the benefits of RDP. "But unless it's locked down, there are concerns whereby anybody with an IP address and login can get access to this particular environment."

RDP shops sell entry to systems that are accessible via port 3389 – the RDP port – due to an issue like misconfiguration or missing two-factor authentication, Samani explains. Systems are advertised with their IP address, country, state, ZIP code, bandwidth, and date of addition. Price varies anywhere between $3 and $20 depending on bandwidth; the type of business is not a factor. Attackers simply have so much access they don't have time to figure out where it all leads.

"They're not going through and looking at the impacted organization," Samani continues. "They've got so much of this [data] that it's economies of scale."

Further open-source searches revealed user accounts including an administrator account and two accounts associated with two companies specializing in airport security (building automation and video surveillance and analytics). Researchers also found a domain likely associated with the airport's automated transit system.

"It's troublesome that a system with such significant public impact might be openly accessible from the Internet," writes John Fokker, head of cyber investigations for McAfee Advanced Threat Research, in a blog post on their findings.

Researchers also found RDP access being sold to multiple government systems, including those linked to the United States, and dozens of connections to healthcare institutions, such as nursing homes and medical equipment suppliers.

"This is not finding a piece of hay in a haystack," Samani says. "This is a business, a huge business that is selling access to organizations and systems all across the world."

To protect their organizations from this level of vulnerability, security managers are advised to take a few precautions: Use complex passwords and two-factor authentication to make brute-force RDP attacks harder to complete; don't allow RDP connections over the open Internet; block IPs after too many failed login attempts; and regularly check for unusual entry attempts.

Related Content:

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
7/11/2018 | 1:33:15 PM
Re: Changing Port 3389
Yep.  This is why we always change the default listening port.  It's been a while, but I believe some clients are locked into support for port 3389 which is why (outside of just being naive) some folks do NOT change the default.  Taking a quick look, it appears the Mac client once didn't support pointing elsewhere, but I can't imagine that would STILL be hard-coded after all these years...
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
7/11/2018 | 12:31:26 PM
Changing Port 3389
Super easy IF you know precisely where to change it!!!!!    It should NEVER be open and IP traffic always should be redirected to another port.  
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25533
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...
CVE-2021-3162
PUBLISHED: 2021-01-15
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVE-2021-21242
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or a...
CVE-2021-21245
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to u...
CVE-2021-21246
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/` endpoint there are no security checks enforced so it is possible to retrieve ar...