Tag Archives: Cyber Security Best Practice

Lessons Learned from the Latest Ransomware Attack on an ESXi Host

19 October 2021

Lisa Vaas’s report about a ransomware attack on a VMware ESXi infrastructure is worth a detailed analysis because it reveals some interesting details on the attackers intentions.

The attack happened very fast and targeted. Vaas cites the Sophos press release: “This is one of the fastest ransomware attacks Sophos has ever investigated, and it appeared to precision-target the ESXi platform”.(Vaas 2021; Sophos Ltd. 2021)

How got the attacker initial access to the network?

The attackers used an inadequately secured TeamViewer remote access to break into the company. The hijacked account “had domain administrator access credentials“.(Sophos Ltd. 2021)

The ransomware operator was not interested in the Active Directory

It is very remarkable that the attackers then focused on the ESXi server. If an attacker is able to hijack an account that is member of the domain administrators group, he has got the keys to the kingdom. An APT would then act very carefully to stay as long as possible undetected.

But the ransomware operator made the right decision. To stay undetected in a network for weeks or months requires technical skills that ransomware operators just lack. This was an economically sensible decision.

The course of events shows some shortcomings in security best practice

Working with TeamViewer in unattended mode without a second factor is bad enough in itself, but, connecting to an account with domain admin privileges under this terms, violates any best practice.

User account control is available since Windows Vista, so there is no need to work with permanent administrative privileges. Moreover, Microsoft makes clear that “There should be no day-to-day user accounts in the DA group with the exception of the local Administrator account for the domain”.(Microsoft 2021)

ESXi servers were transparently accessible in the network, with active shell enabled

„The investigators believe the ESXi Server on the network was vulnerable because it had an active Shell, a programming interface that IT teams use for commands and updates.“(Sophos Ltd. 2021)

The IT team was aware of active shell security issue. “This organization’s IT staff was accustomed to using the ESXi Shell to manage the server, and had enabled and disabled the shell multiple times in the month prior to the attack. However, the last time they enabled the shell, they failed to disable it afterwards. The criminals took advantage of this fortuitous situation when they found the shell was active.”(Brandt 2021)

Adoption of ESXi security best practice would have reduced the impact

Good security practice restricts the accessibility of critical systems like the ESIx host. This can be done by isolating the ESIx hosts in separate network segment and restricting administrative access from an admin segment. Or by configuring the ESXi firewall to allow only connections from dedicated systems.

A good starting point is the VMware guideline “Securing the ESXi Hypervisor”.(VMware Inc. 2020). The DoD VMware ESIx STIG (Security Technical Implementation Guide) gives more details.(Network Frontiers LLC 2018)

Rule SV-77743r1_rule of the VMware ESIx STIG deals with the active shell issue: “The system must terminate shell services after a predetermined period.” The DoD requests to use 600s as timeout.

What can we learn from this attack?

  • Operations security is indispensable.
  • “Defense in depth” must be applied to secure ESXi hosts.
  • Security best practice and hardening guides are available.
  • Security best practice must be implemented and followed.

Have a great day!

References

Brandt, Andrew. 2021. “Python Ransomware Script Targets ESXi Server for Encryption.” Sophos News (blog). October 5, 2021. https://news.sophos.com/en-us/2021/10/05/python-ransomware-script-targets-esxi-server-for-encryption/.

Microsoft. 2021. “Implementing Least-Privilege Administrative Models.” Microsoft Docs. July 29, 2021. https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models#securing-domain-admins-groups.

Network Frontiers LLC. 2018. “VMware VSphere ESXi 6.0 Security Technical Implementation Guide.” STIG Viewer | Unified Compliance Framework®. 2018. https://www.stigviewer.com/stig/vmware_vsphere_esxi_6.0/2019-01-04/.

Sophos Ltd. 2021. “Sophos Researchers Uncover New Python Ransomware Targeting an ESXi Server and Virtual Machines in an Ultra-High-Speed Attack.” Sophos Press Release. October 5, 2021. https://www.sophos.com/en-us/press-office/press-releases/2021/10/sophos-researchers-uncover-new-python-ransomware-targeting-an-esxi-server-and-virtual-machines.aspx.

Vaas, Lisa. 2021. “VMware ESXi Servers Encrypted by Lightning-Fast Python Script.” Threatpost. October 6, 2021. https://threatpost.com/vmware-esxi-encrypted-python-script-ransomware/175374/.

VMware Inc. 2020. “Securing the ESXi Hypervisor.” VMware Docs. February 24, 2020. https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-E9B71B85-FBA3-447C-8A60-DEE2AE1A405A.html.

HiddenWasp malware targets Linux systems – Don’t Panic!

23 June 2019

Ignacio Sanmillan’s excellent post(1) on the HiddenWasp malware could have been truly frightening: HiddenWasp targets Linux systems, the technology used is really impressive, and the detection rate on VirusTotal was zero as of 29 May 2019.

Unfortunately, the infected systems were already under the attacker’s control. Even if anti-malware solutions for Linux would have better detection capabilities it would hardly have mattered. Also, there is no need to implement sophisticated anti-malware evasion technologies. In the easiest case, the attacker must only define an anti-malware exception for the files to be downloaded.

Pattern based anti-malware solutions are reactive protective means. The anti-malware solution provider must first analyze the new malware and create a detection pattern. Thus, it is unsurprising that the detection rate on VirusTotal was and is still low.

The big questions remain open:

  • How was the RAT (Remote Access Trojan), the precondition for the infection with HiddenWasp, initially installed?
  • How did the attackers get root privileges?

Very often, it is lack of cyber hygiene that results in the takeover of a system. Implementation of cyber security best practice will raise the bar. Extended by a restrictive SELinux configuration will reduce the likelihood of getting compromised dramatically.

It’s free, and ready-to-use.

Have a great week.

    References
  1. Sanmillan I. Intezer – HiddenWasp Malware Stings Targeted Linux Systems [Internet]. Intezer. 2019 [cited 2019 Jun 2]. Available from: https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/