Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

7/11/2018
11:30 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

Major International Airport System Access Sold for $10 on Dark Web

Researchers from the McAfee Advanced Threat Research team began with an open search on Russian RDP shop UAS to make their discovery.

Dark Web marketplaces are troves of illicit products and data: stolen credentials, credit card numbers, and, as researchers recently discovered, remote desktop protocol (RDP) access to the security and building automation systems of a major international airport – for the cheap price of $10.

Researchers from the McAfee Advanced Threat Research team used an open search on Ultimate Anonymity Service (UAS), a Russian RDP shop, to search for open RDP ports at that specific organization. They narrowed their search from 65,536 possible IPs to three; by obtaining a complete IP address, they could look up the WHOIS data and find all addresses belonging to a major airport, the name of which is being withheld.

RDP is a proprietary protocol developed by Microsoft to let someone access another machine via graphical interface. It's intended for use by system admins but can be dangerous when attackers use it as an entry point. The recent SamSam ransomware campaign against American businesses is one recent example in which attackers spent $10 for access to a machine and demanded $40,000 in ransom. The actors behind SamSam continue to advance and spread the attack.

RDP shops serve as the foundation for major cyberattacks, reports McAfee, whose researchers scanned several RDP shops selling anywhere between 15 to more than 40,000 connections, the latter of which they discovered at UAS, the largest shop in their research.

RDP access provides a route to target systems without phishing, malware, or an exploit kit. Top use cases for RDP access include spam campaigns, cryptomining, ransomware, planting false flags to disguise illegal activity as coming from a victim's machine, and pilfering system data for identity theft, credit card fraud, account takeover, extortion, and other malicious use cases.

"It's a useful protocol," says McAfee chief scientist Raj Samani, pointing to the benefits of RDP. "But unless it's locked down, there are concerns whereby anybody with an IP address and login can get access to this particular environment."

RDP shops sell entry to systems that are accessible via port 3389 – the RDP port – due to an issue like misconfiguration or missing two-factor authentication, Samani explains. Systems are advertised with their IP address, country, state, ZIP code, bandwidth, and date of addition. Price varies anywhere between $3 and $20 depending on bandwidth; the type of business is not a factor. Attackers simply have so much access they don't have time to figure out where it all leads.

"They're not going through and looking at the impacted organization," Samani continues. "They've got so much of this [data] that it's economies of scale."

Further open-source searches revealed user accounts including an administrator account and two accounts associated with two companies specializing in airport security (building automation and video surveillance and analytics). Researchers also found a domain likely associated with the airport's automated transit system.

"It's troublesome that a system with such significant public impact might be openly accessible from the Internet," writes John Fokker, head of cyber investigations for McAfee Advanced Threat Research, in a blog post on their findings.

Researchers also found RDP access being sold to multiple government systems, including those linked to the United States, and dozens of connections to healthcare institutions, such as nursing homes and medical equipment suppliers.

"This is not finding a piece of hay in a haystack," Samani says. "This is a business, a huge business that is selling access to organizations and systems all across the world."

To protect their organizations from this level of vulnerability, security managers are advised to take a few precautions: Use complex passwords and two-factor authentication to make brute-force RDP attacks harder to complete; don't allow RDP connections over the open Internet; block IPs after too many failed login attempts; and regularly check for unusual entry attempts.

Related Content:

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Christian Bryant
50%
50%
Christian Bryant,
User Rank: Ninja
7/11/2018 | 1:33:15 PM
Re: Changing Port 3389
Yep.  This is why we always change the default listening port.  It's been a while, but I believe some clients are locked into support for port 3389 which is why (outside of just being naive) some folks do NOT change the default.  Taking a quick look, it appears the Mac client once didn't support pointing elsewhere, but I can't imagine that would STILL be hard-coded after all these years...
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
7/11/2018 | 12:31:26 PM
Changing Port 3389
Super easy IF you know precisely where to change it!!!!!    It should NEVER be open and IP traffic always should be redirected to another port.  
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
Can Your Patching Strategy Keep Up with the Demands of Open Source?
Tim Mackey, Principal Security Strategist, CyRC, at Synopsys,  6/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12881
PUBLISHED: 2019-06-18
i915_gem_userptr_get_pages in drivers/gpu/drm/i915/i915_gem_userptr.c in the Linux kernel 4.15.0 on Ubuntu 18.04.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) or possibly have unspecified other impact via crafted ioctl calls to /dev/dri/card0.
CVE-2019-3953
PUBLISHED: 2019-06-18
Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 10012 RPC call.
CVE-2019-12133
PUBLISHED: 2019-06-18
Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system ...
CVE-2019-12592
PUBLISHED: 2019-06-18
A universal Cross-site scripting (UXSS) vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers to run arbitrary web script or HTML in the context of any loaded 3rd-party IFrame.
CVE-2017-8328
PUBLISHED: 2019-06-18
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross site request forgery prot...