Home Security Hackers Exploit Default Credentials in FOUNDATION Software to Breach Construction Firms

Hackers Exploit Default Credentials in FOUNDATION Software to Breach Construction Firms

by


Sep 19, 2024Ravie LakshmananCyber Attack / Hacking

Threat actors have been observed targeting the construction sector by infiltrating the FOUNDATION Accounting Software, according to new findings from Huntress.

“Attackers have been observed brute-forcing the software at scale, and gaining access simply by using the product’s default credentials,” the cybersecurity company said.

Targets of the emerging threat include plumbing, HVAC (heating, ventilation, and air conditioning), concrete, and other related sub-industries.

The FOUNDATION software comes with a Microsoft SQL (MS SQL) Server to handle database operations, and, in some cases, has the TCP port 4243 open to directly access the database via a mobile app.

Huntress said the server includes two high-privileged accounts, including “sa,” a default system administrator account, and “dba,” an account created by FOUNDATION, that are often left with unchanged default credentials.

Cybersecurity

A consequence of this action is that threat actors could brute-force the server and leverage the xp_cmdshell configuration option to run arbitrary shell commands.

“This is an extended stored procedure that allows the execution of OS commands directly from SQL, enabling users to run shell commands and scripts as if they had access right from the system command prompt,” Huntress noted.

First signs of the activity was detected by Huntress on September 14, 2024, with about 35,000 brute-force login attempts recorded against an MS SQL server on one host before gaining successful access.

Of the 500 hosts running the FOUNDATION software across the endpoints protected by the company, 33 of them have been found to be publicly accessible with default credentials.

To mitigate the risk posed by such attacks, it’s recommended to rotate default account credentials, cease exposing the application over the public internet if possible, and disable the xp_cmdshell option where appropriate.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.





Source link

Related Articles

xxxanti beeztube.mobi hot sexy mp4 menyoujan hentaitgp.net jason voorhees hentai indian soft core chupatube.net youjzz ez2 may 8 2023 pinoycinema.org ahensya ng pamahalaan pakistani chut ki chudai pimpmovs.com www xvedio dost ke papa zztube.mobi 300mbfilms.in صور مص الزب arabporna.net نهر العطش لمن تشعر بالحرمان movierulz plz.in bustyporntube.info how to make rangoli video 穂高ゆうき simozo.net 四十路五十路 ロシアav javvideos.net 君島みお 無修正 افلام سكس في المطبخ annarivas.net فيلم سكس قديم rashmi hot videos porncorn.info audiosexstories b grade latest nesaporn.pro high school girls sex videos real life cam eroebony.info painfull porn exbii adult pics teacherporntrends.com nepali school sex