Hackers Infect 50,000 MS-SQL and PHPMyAdmin Servers with Rootkit Malware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2014-4113 | Local Privilege Escalation in Microsoft Win32k Kernel Component (CVE-2014-4113) CVE-2014-4113 is a privilege escalation flaw (CWE-264) in Win32k, the kernel-mode component of Microsoft Windows; Microsoft's description is unspecified, but the flaw allows an attacker to gain elevated privileges on the host. It is triggered by executing a specially crafted application locally on an affected system, typically by an attacker who has already obtained a foothold with limited user rights. Successful exploitation yields higher-privilege (kernel/administrator-level) execution, letting the attacker fully compromise the machine and evade user-level restrictions — a common second stage chained after an initial intrusion. Any Microsoft Windows system of the era whose Win32k component was not patched by Microsoft's October 2014 security updates is affected. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-05-04), carries a very high EPSS score (87%, ~100th percentile), and public reporting has tied it to threat-actor activity (APT3's Operation Double Tap); no public PoC is catalogued. Do: Apply Microsoft's October 2014 security updates — or any later cumulative/rollup updates — on all Windows systems, per CISA's required action, prioritizing internet-exposed and high-value hosts listed in the KEV catalog. Confirm the patched Win32k file version on legacy machines that may have missed these updates. Because this is a local privilege escalation typically chained after an initial foothold, also restrict local execution of untrusted code and limit user privileges on any systems that cannot be patched. | — | 87% | KEV |
| masshundreds of millions of Windows installations of the affected era (Win32k ships with every Windows client/server OS of that period); the count of… |
Full article353 words · extracted from thehackernews.com · click to collapse
The Hacker NewsMay 29, 2019
Cyber Security researchers at Guardicore Labs today published a detailed report on a widespread cryptojacking campaign attacking Windows MS-SQL and PHPMyAdmin servers worldwide.
Dubbed Nansh0u, the malicious campaign is reportedly being carried out by an APT-style Chinese hacking group who has already infected nearly 50,000 servers and are installing a sophisticated kernel-mode rootkit on compromised systems to prevent the malware from being terminated.
The campaign, which dates back to February 26 but was first detected in early-April, has been found delivering 20 different payload versions hosted on various hosting providers.
The attack relies on the brute-forcing technique after finding publicly accessible Windows MS-SQL and PHPMyAdmin servers using a simple port scanner.
Upon successful login authentication with administrative privileges, attackers execute a sequence of MS-SQL commands on the compromised system to download malicious payload from a remote file server and run it with SYSTEM privileges.
In the background, the payload leverages a known privilege escalation vulnerability (CVE-2014-4113) to gain SYSTEM privileges on the compromised systems.
"Using this Windows privilege, the attacking exploit injects code into the Winlogon process. The injected code creates a new process which inherits Winlogon SYSTEM privileges, providing equivalent permissions as the prior version."
The payload then installs a cryptocurrency mining malware on compromised servers to mine TurtleCoin cryptocurrency.
Besides this, the malware also protects its process from terminating using a digitally-signed kernel-mode rootkit for persistence.
"We found that the driver had a digital signature issued by the top Certificate Authority Verisign. The certificate – which is expired – bears the name of a fake Chinese company – Hangzhou Hootian Network Technology."
Researchers have also released a complete list of IoCs (indicators of compromise) and a free PowerShell-based script that Windows administrators can use to check whether their systems are infected or not.
Since the attack relies on a weak username and password combinations for MS-SQL and PHPMyAdmin servers, admins are advised to always keep a strong, complex password for their accounts.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2019/05/hacking-mysql-phpmyadmin.html