By now, you've probably seen some headlines talking about a major hack that just happened
involving some of the world's biggest companies like Shell, British Airways,
BBC, including some government agencies in the US. And this involved a zero-day
exploit for a software called MOVEit, file transfer service that is basically
used to securely transfer files that are supposedly mission-critical, they say.
So in this video I'll go over really two topics. One talking a little bit more about
how this exploit worked. And also another general topic, talking about how you might be wondering,
why do all these companies keep getting hacked? And are you, as a regular user,
residential user of the internet, also at risk of these same hacks?
So first, talking about this hack, it was originally disclosed on May 31st by the parent
company that owns this software. But apparently, the ransomware group that used this knew about
this for like over a year and was possibly even looking for it since 2021. And like I mentioned,
this was a zero-day exploit, which means that the day everyone found out about it,
including the company, was the day the hackers revealed that they were using it actively.
So there was no time to prepare for it. The second they found out about it was because it was being
used to attack people. And while the company did release a patch on May 31st, apparently,
there were more issues and vulnerabilities because they also released patches on June 9th
and June 15th. And there's actually a couple CVEs, which are like exploit identifiers.
And basically, how this exploit worked is it was an SQL injection. SQL is a database,
and a SQL injection is basically tricking the program into making a request to the
database that it's not supposed to. In this case, the MOVEit software was exposed to the
internet, it kind of had to be for its purpose. And the hackers figured out that if they make
a special request to the web portal, web interface, or whatever on the back end,
that they could get a certain file running there to effectively create a new user with admin
privileges and add a "web shell" it's called, to accept controls from the hacker and basically do
arbitrary code execution - whatever they want to do with it. Which included not just stealing all
the data and literally looking at everything they had in their MOVEit transfer database and sending
it to the hackers, but also encrypting all of it locally and demanding the ransom for it.
And I was reading some articles trying to get more details about exactly how this worked,
and I wasn't really able to piece too much together. But basically, from what I understand,
there was one exploit that involved being able to manipulate the database, which was the first SQL
injection. And then there was another exploit that was able to do the remote code execution.
Because from at least one article by the company Huntress, they wrote up a really good article,
I can link it in the description. They said that the web shell file that they dropped,
which they called human2.aspx, they say that dropping this control,
web portal shell thing was not necessary actually to execute the remote code.
They could immediately go to deploying the ransomware if they wanted. So again,
I'm not 100% sure. And in this article, they also showed a couple examples of
some of the requests that were made to do this. And you can see there's a
couple files that were accessed. One was a guest access ASPX file, another was a DLL.
And apparently, you could send a request such that the DLL "did some stuff" that it was not supposed
to. And once they had this web shell up and running, so they could control the hacked server,
it could do a few different things depending on what the hacker wanted. For example,
it could retrieve the Azure system settings and enumerate the underlying SQL database.
Basically, tell them what's in the database. It also allowed the hacker,
once they knew what was in the database, they could send a request to have the shell send
any file that they wanted by that name out. And it looks like it was also able to delete
a account called Health Check Service and replace it with its own with admin
privileges and its own password, which could then be further used to control the computer.
And what makes this hack especially bad is not just that it was a bunch of big companies,
but also the exploit literally had to do with a file transfer service that was meant to transfer
secure files that had to be very secure. So they got all of that. And again, also it involved some
government agencies, at least a couple like the Department of Energy and other reports are
saying the US Department of Agriculture and also the US Office of Personnel Management.
So a lot of stuff going on here. So having heard all this and about a bunch of hacks in the past,
you might be wondering why is it always only companies that seem to get hacked
and why is it never mass hacks of people that get hacked? And really
there's a couple main reasons for this. The first is that a lot of enterprise
software gets targeted simply because big companies have the money to pay the ransoms.
They are going for the money. But another reason is because a lot of times the way
these hacks work, including this past one with a zero-day exploit,
it requires you to be able to interface with that system in the first place to
send the exploit command or whatever it is. And that requires that you have some
kind of public internet-facing server or web interface running on your computer.
And most people simply don't have that because it requires port forwarding,
which a lot of people don't even know what that is, let alone bothering to
do it. I know what port forwarding is and I don't have a reason to do
it. But these companies that are running these servers, you know, they might host a website.
So they of course have to have something public-facing so people can access the
website. Also external services that employees might need to use if they're
not literally within the office. So they have to have some public-facing stuff. And in this case,
the MOVEit service was public-facing and that's why they were able to be sent those commands.
Whereas usually with any consumer-grade router even, the default of the firewall is to simply
block any kind of packet that's incoming that was not solicited. So if your computer sends
out a packet and a request, then it'll get a response and basically have some information
to tell the router that it is a response to something and then it'll let it through.
But if you just get a out-of-the-blue request, the firewall is just going to completely
discard it. So it's not going to get into your network in any way unless,
say you are hosting a game server or something on your network, then you can open a port which
forwards some of the data to that specific server on that port so that people can connect to it.
But that also means that of course that if there's an exploit on that game server,
then someone can connect and use it. But again, going back to the main topic, most people by
far do not do that. So most of the time it's just not worth it to target software that most people,
even if they have it installed, it's not going to be public-facing in any way.
And even if you do hack a lot of those people, are they going to have a lot of
money to pay? It might just be easier to send out mass phishing emails with a virus
attached or something like that. So that's usually how individual people get attacked,
is downloading something, not a zero-day exploit on their network coming in as a request.
The other type of zero-day exploit is like if it's a web browser exploit,
then if you go on a website that interfaces with the browser, that could also be an option. And
that's another reason why you always want to keep your browser and any software you have
installed on your computer up to date, including the operating system itself.
Because it doesn't have to just be public-facing and port forwarded to get hacked. If you go out
and touch something that is designed to infect an exploit-vulnerable software, then you might
get got. And also another advantage hackers can have is they can basically scan the internet for
how many servers are out there that are running a particular software that they know they can hack.
So they can basically figure out if it's worth it or not from the
get-go. And in that article by Huntress, they mentioned that they did a scan and
found at least 2,500 servers that were publicly running this MOVEit software.
And you better hope that they're all patched. Though again, the problem with
the zero-day is by the time they found out about the hack, it was already being used.
So they kind of hit a bunch of companies at the same time. There wasn't any time
to react until after the fact and you could maybe look to see if you were
hacked and limit the damage afterwards and make sure that they're not still in
there. But that's really all you could do. They probably already got all the stuff.
But again, going back to the main point, as a regular residential internet user,
you don't really have to worry about these kinds of specific attacks. Mainly,
you're going to be looking out for phishing attacks, links to malicious
software downloads, that sort of thing is more targeted towards individual users.
So those are just some thoughts. If you have more to add or maybe I've messed something up,
of course let me know down in the comments. I do try to read as many as I can. And also,
if you enjoyed the video, be sure to give it a big giant thumbs up for the YouTube algorithm. And if
you want to keep watching, the next video I'd recommend is where I was talking about
some security tips for Chromium browsers like Google Chrome, Edge, and also Firefox as well.
So definitely recommend watching that. I'll put that link right
there. So thanks so much for watching and I'll see you in the next one.