Cybersecurity Fundamentals

The Attack Chain

The attack itself started with a SQL injection attack. The Open Worldwide Application Security Project (OWASP) shows us that a SQL injection attack is when an attacker enters, or “injects” a SQL command into a data field with the intent of interacting with the underlying SQL database. A successful SQL injection exploit can allow an attacker to read data from the database, modify the database, either by writing, changing, or even deleting data, or in some cases execute commands or programs [6]. In the case of MOVEit, Cl0p used the SQL injection to install a customized webshell called LEMURLOOT. A webshell is malicious script that is uploaded to an existing web server. It listens for carefully crafted HTTP requests and responds, giving attackers a persistent backdoor with the web server's permissions. Before we travel too far down the attack chain, lets address the elephant in the room. The thing about SQL injections is they are generally easy to protect against. The counter to a SQL injection is input validation. SQL injection relies on using special characters that have meaning to a SQL server and can then be interpreted as commands. For example a single quote could be used to prematurely end the text field that the application is asking you to fill, and then a semicolon end the command, allowing the attacker to input a new, second command. Input validation simply examines the content of the field before passing it to the SQL server and either sanitizes it by commenting out the special characters so the server does not interpret them as commands, or by rejecting the input and asking the user to try again. According to Holden, as cited by Plumb in SDXCentral [7], the entire event was caused by “very sophomoric-level vulnerabilities found within the MOVEit software.” Once the LEMURLOOT web shell was deployed (disguised as human2.aspx to look like the legitimate file human.aspx) it acted as a persistent backdoor and allowing the attackers to send commands via HTTP headers. These commands included querying the MOVEit database, creating temporary admin accounts, and downloading files. They even collected Progress Software customer’s Azure storage keys and were then able to pivot to downloading files from Azure [2,5,7]. Once Cl0p had the files, they began sending ransom demands, and if the customers didn’t pay, they published the files on leak sites, or, as a first for Cl0p, as torrents. Torrents made the data much more resilient against take-down requests as torrents are decentralized [2].
In summary, Cl0p used a zero-day vulnerability that affected even the most well-managed systems, since there was no patch for it. They moved fast, but even after the patch was released, customers had poor patch management and remained vulnerable. A lot of the mass exploitation happened here. Many customers had poor logging, or just didn’t check their logs and didn’t even know they were compromised until Cl0p announced it. Without logs, you’re blink, both during and after an attack. A final factor in the attack we’ve already touched on, is because of what MOVEit is: a secure file transfer tool. As such it had direct access to the most sensitive files that need to be transferred securely.