Travelex extorted by ransomware gang, services still offline a week after the hit
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-11510 | Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN Ivanti Pulse Connect Secure, an enterprise SSL VPN appliance, contains an arbitrary file read vulnerability (CWE-22, path traversal) that requires no authentication. An unauthenticated remote attacker with network access to the appliance over HTTPS can send a specially crafted URI containing traversal sequences to read arbitrary files from the device. The attacker gains access to sensitive appliance files, potentially including configuration or credential material useful for further compromise, and CISA records known ransomware use of this flaw. Any organization running Pulse Connect Secure, especially gateways exposed to the internet for remote access, is affected. Exploitation is established: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, EPSS assigns a 100% probability of exploitation in the next 30 days, and no public PoC is known. Do: Apply updates per Ivanti's instructions, the required action in the CISA KEV entry, prioritizing internet-facing Pulse Connect Secure gateways, and consult the vendor advisory for the applicable fixed release since no version range is provided here. Where patching is not immediate, restrict HTTPS access to the appliance and hunt for signs of exploitation (unexpected file reads, anomalous VPN logins or sessions, and follow-on ransomware activity), as CISA reports known ransomware use. | 10.0 | 100% | KEV ransomware PoC ×2 |
| largeTens of thousands of internet-exposed gateways (order of 10,000-100,000 systems; each typically serves hundreds of VPN users, so potentially millions of users) |
Full article551 words · extracted from helpnetsecurity.com · click to collapse
On the last day of 2019, foreign exchange company Travelex was hit by cyber attackers wielding the Sodinokibi (aka REvil) ransomware. More than a week later, the company’s websites and online services are still offline despite the company’s remediation efforts.
Current situation
“Travelex has proactively taken steps to contain the spread of the ransomware, which has been successful. To date, the company can confirm that whilst there has been some data encryption, there is no evidence that structured personal customer data has been encrypted. Whist Travelex does not yet have a complete picture of all the data that has been encrypted, there is still no evidence to date that any data has been exfiltrated,” the company stated on Tuesday.
“Having completed the containment stage of its remediation process, detailed forensic analysis is fully underway and the company is now also working towards recovery of all systems. To date Travelex has been able to restore a number of internal systems, which are operating normally.”
IT specialists and cyber security experts are working on getting everything back in order, but the company did not say when they expect to resume normal operations. The attack has also disrupted the work of many banks who rely on Travelex to provide their foreign exchange services.
“Travelex is in discussions with the National Crime Agency (NCA) and the Metropolitan Police who are conducting their own criminal investigations, as well as its regulators across the world,” the company added.
The BBC reports that the attackers are asking for $6 million (£4.6 million) in exchange for giving the firm access to its encrypted files, and are threatening to publicly release 5GB of customers’ personal data if Travelex doesn’t pay the ransom.
The attackers claim to have had access to the company’s computer network for the last six months, which allowed them to download customer data.
The UK Information Commissioner’s Office (ICO) has yet to receive a data breach report from the company and neither have the customers who ordered currency from Travelex before the attack and paid for it, but are unable to collect it.
How did the attackers manage to breach Travelex?
We still don’t know for sure through which hole the attackers managed to infiltrate the company’s networks, but there’s speculation that unpatched Pulse Secure VPN servers were the way in.
Pulse Secure patched CVE-2019-11510, an arbitrary file reading vulnerability in Pulse Connect Secure that can be easily exploited remotely to download files/extract sensitive information from the vulnerable servers, in April 2019. A few months later, exploits were made public and researchers released technical details about the flaw.
Cyber threat intelligence outfit Bad Packets has been pinpointing owners of unpatched Pulse Secure VPN servers and notifying them about the threat for many months now, and notified Travelex (through national CERTs) about their own seven vulnerable servers on September 13, 2019.
We notified Travelex about their vulnerable Pulse Secure VPN servers on September 13, 2019.
No response. pic.twitter.com/lCjk7IY3OM
— Bad Packets Report (@bad_packets) January 4, 2020
Apparently, it took Travelex two months to patch them.
Also, according to Kevin Beaumont, “Travelex’s AWS platform had Windows servers with RDP enabled to internet and NLA disabled,” meaning that the attackers could have connected to and executed code on the servers after brute-forcing their way in through internet-accessible login screens.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2020/01/08/travelex-ransomware/