A hacktivist group known as GhostSec has claimed on a public Telegram group that it has been able to encrypt an industrial remote terminal unit (RTU) router that features SCADA capabilities including support for industrial serial interfaces RS-232 and RS-485, and MODBUS protocol variations.
GhostSec has been called an adjunct group to Anonymous, carrying out politically motivated hacks, including one claim this week that it had access to, and stolen, email from the Brazilian government. It has also previously been connected to compromises of programmable logic controllers and other OT devices.
In this alleged attack, the group has apparently turned its attention to the Russian invasion of Ukraine. From screenshots provided by the group on Telegram, encrypted files on a TELEOFIS RTU968 v2 in question have had the suffix “.f***Putin” appended to them.
The group claimed on Telegram that the compromised device is from Belarus, and also did not demand a ransom, instead leaving behind a lengthy message that includes the note: “There is no notification letter. There is no payment.”
The TELEOFIS RTU968 V2 is a new 3G router that supports wired and wireless connections of commercial and industrial facilities to the Internet. The built-in 3G modem will provide high-speed wireless Internet access anywhere where there is a network coverage of a cellular operator. It could be considered a remote terminal unit (RTU) because it supports Industrial interfaces RS-232 and RS-485 and is able to convert industrial protocols Modbus RTU/ASCII to Modbus TCP.
From public internet scans we discovered that there are 194 internet-exposed devices in Russia, Kazakhstan, Belarus, and 117 of them have the SSH service enabled.
We were curious to know what was the initial attack vector so we downloaded the firmware and conducted research on it (.tar → .UBI root filesystem, Linux kernel).
We discovered that the device runs over a 32-bit ARM architecture with an ARM926EJ-S processor which is part of ARM9 family of general-purpose microprocessors. It runs the OpenWrt 21.02.2 operating system, which is a Linux distribution with BusyBox.
After going through the device’s configurations and rc.d startup scripts, we came to the conclusion that the device comes with a pre-configured SSH service on port 22 (default port) and allows using a root password as a method of authentication. Furthermore, the device comes with a weak preconfigured root password that can be broken with the hashcat password recovery tool in two seconds.
Hacktivist groups, though largely politically motivated, have demonstrated the ability to be disruptive to businesses and operations in certain situations. GhostSec’s latest alleged activity is another indication that these groups have an interest in seeking out ICS devices that—if attacked—can impact productivity and safety within industrial automation settings.
CWE-78 Improper Neutralization of Special Elements used in an OS Command:
A remote unauthenticated attacker who has bypassed authentication could execute arbitrary OS commands to disclose, tamper with, destroy or delete information in Mitsubishi Electric smartRTU, or cause a denial-of service condition on the product.
Mitsubishi Electric Europe B.V. recommends that users take note of the following mitigation measures to minimize the risk of exploiting this vulnerability:
CVSS v3: 9.8
CWE-306: Missing Authentication for Critical Function:
A remote unauthenticated attacker may be able to bypass authentication by utilizing a specific API route to execute arbitrary OS commands.
Mitsubishi Electric Europe B.V. recommends that users take note of the following mitigation measures to minimize the risk of exploiting this vulnerability:
CVSS v3: 7.5
CWE-547 USE OF HARD-CODED, SECURITY-RELEVANT CONSTANTS:
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients.
Optigo Networks recommends users to upgrade to the following:
CVSS v3: 7.5
CWE-288 AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL:
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products.
Optigo Networks recommends users to upgrade to the following:
CVSS v3: 9.8
CWE-547 USE OF HARD-CODED, SECURITY-RELEVANT CONSTANTS:
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT (JSON Web Token) sessions.
Optigo Networks recommends users to upgrade to the following:
CVSS v3: 7.5
