Abo
  • Services:

University uses old version with known Vulnerabilities

We could not find out how exactly the attack happened, because none of the involved institutions have given us a statement yet. An analysis of the software however brought up some details that may give a hint.

Stellenmarkt
  1. Hannoversche Informations­technologien AöR, Hannover
  2. Bundeskriminalamt, Wiesbaden

In our research we were able to see the version of Ilias on the affected web page via the Google cache. According to that the site was operated with Ilias version 5.1.16. This version was released a year ago in March 2017. Since then, many security updates have been issued that apparently weren't installed.

The upload of SVG files enabled a cross-site scripting vulnerability, another cross-site scripting vulnerability was found due to a lack of filtering of form inputs. In some situations, a flaw in the delivery of e-mails could cause the delivery of system mails to the wrong user. In October 2017 a vulnerability in the handling of media files was found, though no details about the impact were published. In early February 2018, another cross site scripting vulnerability was found.

Exploiting such vulnerabilities usually requires the attacker tricking the victim into clicking on a malicious link or accessing a specific portion of a site containing attacker-controlled code. This is usually more complicated to exploit than some other classes of vulnerabilities that allow immediate code execution or the extraction and manipulation of data. But for a professional attacker it is still a realistic scenario.

A severe vulnerability was fixed in the version 5.1.16 that the University had used. According to the description it allowed copying files to arbitrary places on the file system. That would probably make it relatively easy to completely take over an installation and execute code. This vulnerability was fixed in the version that was active until a few days ago, but according to previous reports the attack had started several months before it was detected in December 2017.

Administrator account with default Password "homer"

During the analysis of Ilias we found another weakness. After a fresh installation of the system a default account with administrator permissions is created. This is assigned the username "root" and the password "homer". The user is not asked to change the default password. Therefore it's possible that the default password was simply never changed.

We found no easy way to directly execute code with an administrator account, but of course it is possible that such a vector exists and we simply haven't found it.

It's also possible that the attack happened with a yet unknown vulnerability or with login data that was stolen via phishing. The Ilias system is quite extensive and has many possibilities for users to interact with it. File uploads of various media formats, a wiki, a plugin system and a lot of other features provide a large attack surface.

Approved by NATO

During our research we found a report from 2008. According to this, NATO tested the Ilias software for three days and didn't find any security flaws. Ilias can therefore be used in NATO's internal network Chronos. Also according to the report, Ilias was used by NATO to prepare soldiers for the ISAF mission in Afghanistan.

Please notice: The German version of this article can be read here.

 Government Hack: Hack on German Government via E-Learning Software Ilias
  1.  
  2. 1
  3. 2


Anzeige
Blu-ray-Angebote
  1. (2 Monate Sky Ticket für nur 4,99€)

hg (Golem.de) 12. Mär 2018

Wir haben in diesem Fall auch eine englische Version des Artikels gemacht, weil wir die...


Folgen Sie uns
       


Bethesda E3 2018 Pressekonferenz -Live

Fallout 76 wird Multiplayer bieten, Starfield und Elder Scrolls 6 werden angekündigt und Bethesda bringt mit Rage 2 und Doom Eternal jede Menge Action: Konnte uns das im nächtlichen Stream begeistern?

Bethesda E3 2018 Pressekonferenz -Live Video aufrufen
Sun to Liquid: Wie mit Sonnenlicht sauberes Kerosin erzeugt wird
Sun to Liquid
Wie mit Sonnenlicht sauberes Kerosin erzeugt wird

Wasser, Kohlendioxid und Sonnenlicht ergeben: Treibstoff. In Spanien wird eine Anlage in Betrieb genommen, in der mit Hilfe von Sonnenlicht eine Vorstufe für synthetisches Kerosin erzeugt oder Wasserstoff gewonnen wird. Ein Projektverantwortlicher vom DLR hat uns erklärt, warum die Forschung an Brennstoffen trotz Energiewende sinnvoll ist.
Ein Bericht von Werner Pluta

  1. Deep Sea Mining Deep Green holte Manganknollen vom Meeresgrund
  2. Klimaschutz Unter der Erde ist das Kohlendioxid gut aufgehoben
  3. Physik Maserlicht aus Diamant

IT-Jobs: Fünf neue Mitarbeiter in fünf Wochen?
IT-Jobs
Fünf neue Mitarbeiter in fünf Wochen?

Startups müssen oft kurzfristig viele Stellen besetzen. Wir waren bei dem Berliner Unternehmen Next Big Thing dabei, als es auf einen Schlag Bewerber für fünf Jobs suchte.
Ein Bericht von Juliane Gringer

  1. Frauen in IT-Berufen Programmierte Klischees
  2. Bitkom Research Höherer Frauenanteil in der deutschen IT-Branche
  3. Recruiting IT-Experten brauchen harte Fakten

Elektroautos: Ladesäulen und die Tücken des Eichrechts
Elektroautos
Ladesäulen und die Tücken des Eichrechts

Wenn Betreiber von Ladestationen das Wort "eichrechtskonform" hören, stöhnen sie genervt auf. Doch demnächst soll es mehr Lösungen geben, die die Elektromobilität mit dem strengen deutschen Eichrecht in Einklang bringen. Davon profitieren Anbieter und Fahrer gleichermaßen.
Eine Analyse von Friedhelm Greis

  1. WE Solutions Günstige Elektroautos aus dem 3D-Drucker
  2. Ladesäulen Chademo drängt auf 400-kW-Ladeprotokoll für E-Autos
  3. Elektromobiltät UPS kauft 1.000 Elektrolieferwagen von Workhorse

    •  /