Team82 Blog / 2 min read
A hacktivist group known as GhostSec has claimed on a public Telegram group that it has been able to encrypt an industrial remote terminal unit (RTU) router that features SCADA capabilities including support for industrial serial interfaces RS-232 and RS-485, and MODBUS protocol variations.
GhostSec has been called an adjunct group to Anonymous, carrying out politically motivated hacks, including one claim this week that it had access to, and stolen, email from the Brazilian government. It has also previously been connected to compromises of programmable logic controllers and other OT devices.
In this alleged attack, the group has apparently turned its attention to the Russian invasion of Ukraine. From screenshots provided by the group on Telegram, encrypted files on a TELEOFIS RTU968 v2 in question have had the suffix “.f***Putin” appended to them.
The group claimed on Telegram that the compromised device is from Belarus, and also did not demand a ransom, instead leaving behind a lengthy message that includes the note: “There is no notification letter. There is no payment.”
The TELEOFIS RTU968 V2 is a new 3G router that supports wired and wireless connections of commercial and industrial facilities to the Internet. The built-in 3G modem will provide high-speed wireless Internet access anywhere where there is a network coverage of a cellular operator. It could be considered a remote terminal unit (RTU) because it supports Industrial interfaces RS-232 and RS-485 and is able to convert industrial protocols Modbus RTU/ASCII to Modbus TCP.
From public internet scans we discovered that there are 194 internet-exposed devices in Russia, Kazakhstan, Belarus, and 117 of them have the SSH service enabled.
We were curious to know what was the initial attack vector so we downloaded the firmware and conducted research on it (.tar → .UBI root filesystem, Linux kernel).
We discovered that the device runs over a 32-bit ARM architecture with an ARM926EJ-S processor which is part of ARM9 family of general-purpose microprocessors. It runs the OpenWrt 21.02.2 operating system, which is a Linux distribution with BusyBox.
After going through the device’s configurations and rc.d startup scripts, we came to the conclusion that the device comes with a pre-configured SSH service on port 22 (default port) and allows using a root password as a method of authentication. Furthermore, the device comes with a weak preconfigured root password that can be broken with the hashcat password recovery tool in two seconds.
Hacktivist groups, though largely politically motivated, have demonstrated the ability to be disruptive to businesses and operations in certain situations. GhostSec’s latest alleged activity is another indication that these groups have an interest in seeking out ICS devices that—if attacked—can impact productivity and safety within industrial automation settings.
CWE-676: Use of Potentially Dangerous Function may allow security feature bypass
CVSS v3: 8.0
CWE-703: Improper Check or Handling of Exceptional Conditions may allow denial of service
CVSS v3: 8.0
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605. Authentication is required to exploit this vulnerability.
The specific issue exists within the handling of the name field in the access control user interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
The flaw was addressed in firmware: ER605(UN)_V2_2.2.3 Build 20231201
CVSS v3: 6.8
Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors.
The vulnerability allows man-in-the-middle attackers to execute arbitrary code or access intranet resources via a susceptible version of Synology Router Manager (SRM).
CVSS v3: 7.5
The vulnerabilities, if explooited, may risk exposure of SNMP credentials and escalation of privileges which could cause unauthorized changes to the system configuration.
CVSS v3: 4.5