Baltimore's Union Memorial Hospital is the epicenter of a malware attack upon its parent organization, MedStar. Data at Union Memorial and other MedStar hospitals in Maryland have been encrypted by ransomware spread across the network, and the operators of the malware are offering a bulk deal: 45 bitcoins (about $18,500) for the keys to unlock all the affected systems.
Reuters reports that the FBI issued a confidential urgent "Flash" message to the industry about the threat of Samsam on March 25, seeking assistance in fighting the ransomware and pleading, "We need your help!" The FBI's cyber center also shared signature data for Samsam activity to help organizations screen for infections. But the number of potential targets remains vast, and the FBI was concerned that entire networks could fall victim to the ransomware.
According to sources who spoke to the Baltimore Sun, the malware involved in MedStar's outages is Samsam, also known as Samas and MSIL. The subject of a recent confidential FBI cyber-alert, Samsam is form of malware that uses well-known exploits in the JBoss application server and other Java-based application platforms. As Ars reported on Monday, Samsam uses exploits published as part of JexBoss, an open-source security and penetration testing tool for checking JBoss servers for misconfiguration.
The exploited vulnerabilities are in the JBoss Management Console (JMX), the command-line interface used to control JBoss-based application servers. The default installation of JBoss leaves JMX unsecured from outside access. The attacker uses these exploits to get remote shell access to the server itself and install Samsam malware onto the targeted Web application server. From there, the server is used to spread the ransomware client to Windows machines. There's no communication with a command and control network once the server is compromised.
According to Craig Williams of Cisco's Talos Research, an Internet scan by Talos revealed approximately 2.1 million systems vulnerable to the JBoss exploit used in the attack. And other JMX-based exploits that have been known for more than a year are waiting in the wings to strike systems based on JBoss and related systems such as WebLogic, WebSphere, the open-source Jenkins automation server, and the OpenNMS network management platform.
Aside from JexBoss, there are several other proof-of-concept and even "weaponized" exploits of JBoss already publicly available. Some security researchers have speculated that these could be used as part of a self-spreading "worm" malware that scans for exploitable servers and then works its way into the networks attached to them.
Update, March 31, 2:45 PM: Dell SecureWorks released a detailed analysis of the attack methods used to spread Samsam on Wednesday, based on data collected from a number of ransomware incidents. It's clear that the JBoss systems compromised were Windows servers, and not Linux machines, based on the use of the credentials collection tool. The attacks consisted of:
- A compromise of a JBoss server using one of several versions of the JexBoss tool;
- Installation on the compromised server of a Python-based SOCKS proxy to conceal communications with systems within the network;
- Installation and use of a Windows credentials collection tool to steal user credentials for use in moving laterally within the network;
- Network reconnaissance using the Hyena Windows network scanning tool to locate more Windows machines to attack.
- Use of stolen credentials to connect to found systems and implant Samsam.
Harlan Carvey, senior infosecurity researcher at SecureWorks, said that the penetration of the networks SecureWorks examined appeared to be done manually. "Given the timeframe at which the commands were run, none of the data we saw suggests it was automated," he said. The JBoss servers were initially hit weeks or even months before the introduction of the Samsam ransomware. "While the times varied between the individual cases, none of this appeared to be automated or scripted," Carvey concluded, "particularly the installation of Hyena, the scanning tools from System Tools...that was clearly manual.”
When asked if the attack could be automated in the future, Carvey replied, "I'm sure portions of the attack could be...not sure about the whole thing, though. There are parts of what I'm seeing, like the use of Hyena, that requires that someone access the desktop. Now, they could change how they go about that but even if they automate it, that's even more of a reason to have an Advanced Endpoint Threat Detection solution."
reader comments
85