We could not find out how exactly the attack happened, because none of the involved institutions have given us a statement yet. An analysis of the software however brought up some details that may give a hint.
In our research we were able to see the version of Ilias on the affected web page via the Google cache. According to that the site was operated with Ilias version 5.1.16. This version was released a year ago in March 2017. Since then, many security updates have been issued that apparently weren't installed.
The upload of SVG files enabled a cross-site scripting vulnerability, another cross-site scripting vulnerability was found due to a lack of filtering of form inputs. In some situations, a flaw in the delivery of e-mails could cause the delivery of system mails to the wrong user. In October 2017 a vulnerability in the handling of media files was found, though no details about the impact were published. In early February 2018, another cross site scripting vulnerability was found.
Exploiting such vulnerabilities usually requires the attacker tricking the victim into clicking on a malicious link or accessing a specific portion of a site containing attacker-controlled code. This is usually more complicated to exploit than some other classes of vulnerabilities that allow immediate code execution or the extraction and manipulation of data. But for a professional attacker it is still a realistic scenario.
A severe vulnerability was fixed in the version 5.1.16 that the University had used. According to the description it allowed copying files to arbitrary places on the file system. That would probably make it relatively easy to completely take over an installation and execute code. This vulnerability was fixed in the version that was active until a few days ago, but according to previous reports the attack had started several months before it was detected in December 2017.
Administrator account with default Password "homer"
During the analysis of Ilias we found another weakness. After a fresh installation of the system a default account with administrator permissions is created. This is assigned the username "root" and the password "homer". The user is not asked to change the default password. Therefore it's possible that the default password was simply never changed.
We found no easy way to directly execute code with an administrator account, but of course it is possible that such a vector exists and we simply haven't found it.
It's also possible that the attack happened with a yet unknown vulnerability or with login data that was stolen via phishing. The Ilias system is quite extensive and has many possibilities for users to interact with it. File uploads of various media formats, a wiki, a plugin system and a lot of other features provide a large attack surface.
Approved by NATO
During our research we found a report from 2008. According to this, NATO tested the Ilias software for three days and didn't find any security flaws. Ilias can therefore be used in NATO's internal network Chronos. Also according to the report, Ilias was used by NATO to prepare soldiers for the ISAF mission in Afghanistan.
Please notice: The German version of this article can be read here.
|Government Hack: Hack on German Government via E-Learning Software Ilias|