Accounting software brute force attacks hit construction companies

Hackers are targeting construction companies with brute-force attacks, breaking into their networks and executing different commands remotely, experts have warned.

Cybersecurity researchers Huntress, who recently observed the attacks in the wild, noted cybercriminals are going after Foundation – a piece of software used by construction companies for accounting and project management. It helps manage financials, job costing, payroll, and reporting, and offers tools for tracking expenses, managing contracts, and staying compliant with industry regulations.

This software also has an accompanying mobile app, and in order for it to work properly, a Microsoft SQL Server (MSSQL) needs to be configured to be publicly accessible via TCP port 4243. This server has two admin accounts, and in many instances – users never changed the default passwords.

Running commands

Cybercriminals seem to have picked up on this information, targeting dozens of organizations with brute-force attacks, in an attempt to log into these accounts. In fact, Huntress spotted 35,000 attempts on a single host, within an hour. The researchers said they saw “active breaches” in organizations working on plumbing, HVAC, concrete, and similar.

After gaining access, the attackers try to enable features that allow them to run commands on the operating system. Some of the commands observed by the researchers were to retrieve network configuration details and pull information about the hardware, OS, and user accounts.

Huntress says that of all the endpoints it defends, 500 hosts were seen running Foundation, 33 of which had publicly exposed MSSQL databases with default admin credentials. The researchers notified the company of their findings, but Foundation said the problem only affects on-prem instances. In other words, software users should be the ones minding their security posture. The company did stress that not all servers have the same port open, and not everyone has the same default credentials.

Via BleepingComputer