Online password services exploited? Really?
<Gets up off of floor after being struck by a passing feather>
You'll never guess who's been exploiting the ManageEngine service to steal passwords
Palo Alto Networks' Unit 42 research team has said criminals using tools accompanied by Chinese instructions gained access to high-interest networks and stole passwords after exploiting at least 370 password management services in the US. "As early as September 17 the actor leveraged leased infrastructure in the United States …
-
-
Tuesday 9th November 2021 06:19 GMT chuBb.
It's not really an online password service, I mean some twat will have made it publically available. It's more of a hell desk front end to basic AD user operations password reset account unlock that sort of thing
Basically could be severely hampered by MFA and using a more modern approach to AAA
Won't be surprised to see more efforts directed at "internal" business support systems now external security is generally better in 3rd party solutions than internal
-
-
Tuesday 9th November 2021 07:59 GMT chuBb.
Not relying on a single authentication method for authorisation.
xkcd password with alternating capitisation and if Warrentted numeric substitution, coupled with a pin and or an authenticator app or one use token is my minimum recommendation
As for post it note what ever works for you, although I'd be more inclined to write a mnemonic or an acrostic for an xkcd password than the actual password
-
-
-
-
-
-
-
Tuesday 9th November 2021 14:36 GMT chuBb.
Re: Out of curiosity...
It's not so much the payload that's the problem (plain text interpreted script) it's that it's possible to execute an uploaded file that's the issue.
What must be happening (I've not looked at specifics) is:
Zip is uploaded and extracted
Tomcat is set to engage java for all file requests (typically you would exclude any static files from wasting server resources, manage engine have a very lan centric trusted environment expectation with their out of box configs runs as root and sets the execute bit by default on file permissions on the *nix installer for example)
Because of this misconfiguration the attackers script is executable and good bye server you've been pwned.
The payload zip file would be a couple of kb in size and would require actual inspection to be detected as a zipped pem file and a zipped jsp would look very very similar in a hex editor...
-
-
-
-
Tuesday 9th November 2021 10:10 GMT Anonymous Coward
China
Is is just me or does the “Chinese instructions” bit actually scream NSA left a note saying “China woz ‘ere”? I can’t tell these days what’s US propaganda and what’s genuine, but I am quite certain there’s a LOT of propaganda against China as the US is terrified of losing the top spot globally.
