Threat Intelligence

7/11/2018
11:30 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

Major International Airport System Access Sold for $10 on Dark Web

Researchers from the McAfee Advanced Threat Research team began with an open search on Russian RDP shop UAS to make their discovery.

Dark Web marketplaces are troves of illicit products and data: stolen credentials, credit card numbers, and, as researchers recently discovered, remote desktop protocol (RDP) access to the security and building automation systems of a major international airport – for the cheap price of $10.

Researchers from the McAfee Advanced Threat Research team used an open search on Ultimate Anonymity Service (UAS), a Russian RDP shop, to search for open RDP ports at that specific organization. They narrowed their search from 65,536 possible IPs to three; by obtaining a complete IP address, they could look up the WHOIS data and find all addresses belonging to a major airport, the name of which is being withheld.

RDP is a proprietary protocol developed by Microsoft to let someone access another machine via graphical interface. It's intended for use by system admins but can be dangerous when attackers use it as an entry point. The recent SamSam ransomware campaign against American businesses is one recent example in which attackers spent $10 for access to a machine and demanded $40,000 in ransom. The actors behind SamSam continue to advance and spread the attack.

RDP shops serve as the foundation for major cyberattacks, reports McAfee, whose researchers scanned several RDP shops selling anywhere between 15 to more than 40,000 connections, the latter of which they discovered at UAS, the largest shop in their research.

RDP access provides a route to target systems without phishing, malware, or an exploit kit. Top use cases for RDP access include spam campaigns, cryptomining, ransomware, planting false flags to disguise illegal activity as coming from a victim's machine, and pilfering system data for identity theft, credit card fraud, account takeover, extortion, and other malicious use cases.

"It's a useful protocol," says McAfee chief scientist Raj Samani, pointing to the benefits of RDP. "But unless it's locked down, there are concerns whereby anybody with an IP address and login can get access to this particular environment."

RDP shops sell entry to systems that are accessible via port 3389 – the RDP port – due to an issue like misconfiguration or missing two-factor authentication, Samani explains. Systems are advertised with their IP address, country, state, ZIP code, bandwidth, and date of addition. Price varies anywhere between $3 and $20 depending on bandwidth; the type of business is not a factor. Attackers simply have so much access they don't have time to figure out where it all leads.

"They're not going through and looking at the impacted organization," Samani continues. "They've got so much of this [data] that it's economies of scale."

Further open-source searches revealed user accounts including an administrator account and two accounts associated with two companies specializing in airport security (building automation and video surveillance and analytics). Researchers also found a domain likely associated with the airport's automated transit system.

"It's troublesome that a system with such significant public impact might be openly accessible from the Internet," writes John Fokker, head of cyber investigations for McAfee Advanced Threat Research, in a blog post on their findings.

Researchers also found RDP access being sold to multiple government systems, including those linked to the United States, and dozens of connections to healthcare institutions, such as nursing homes and medical equipment suppliers.

"This is not finding a piece of hay in a haystack," Samani says. "This is a business, a huge business that is selling access to organizations and systems all across the world."

To protect their organizations from this level of vulnerability, security managers are advised to take a few precautions: Use complex passwords and two-factor authentication to make brute-force RDP attacks harder to complete; don't allow RDP connections over the open Internet; block IPs after too many failed login attempts; and regularly check for unusual entry attempts.

Related Content:

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
7/11/2018 | 12:31:26 PM
Changing Port 3389
Super easy IF you know precisely where to change it!!!!!    It should NEVER be open and IP traffic always should be redirected to another port.  
No SOPA
50%
50%
No SOPA,
User Rank: Ninja
7/11/2018 | 1:33:15 PM
Re: Changing Port 3389
Yep.  This is why we always change the default listening port.  It's been a while, but I believe some clients are locked into support for port 3389 which is why (outside of just being naive) some folks do NOT change the default.  Taking a quick look, it appears the Mac client once didn't support pointing elsewhere, but I can't imagine that would STILL be hard-coded after all these years...
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14492
PUBLISHED: 2018-07-21
Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
CVE-2018-3770
PUBLISHED: 2018-07-20
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVE-2018-3771
PUBLISHED: 2018-07-20
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.