• Services:

University uses old version with known Vulnerabilities

We could not find out how exactly the attack happened, because none of the involved institutions have given us a statement yet. An analysis of the software however brought up some details that may give a hint.

  1. Kratzer EDV GmbH, München
  2. Dataport, verschiedene Standorte

In our research we were able to see the version of Ilias on the affected web page via the Google cache. According to that the site was operated with Ilias version 5.1.16. This version was released a year ago in March 2017. Since then, many security updates have been issued that apparently weren't installed.

The upload of SVG files enabled a cross-site scripting vulnerability, another cross-site scripting vulnerability was found due to a lack of filtering of form inputs. In some situations, a flaw in the delivery of e-mails could cause the delivery of system mails to the wrong user. In October 2017 a vulnerability in the handling of media files was found, though no details about the impact were published. In early February 2018, another cross site scripting vulnerability was found.

Exploiting such vulnerabilities usually requires the attacker tricking the victim into clicking on a malicious link or accessing a specific portion of a site containing attacker-controlled code. This is usually more complicated to exploit than some other classes of vulnerabilities that allow immediate code execution or the extraction and manipulation of data. But for a professional attacker it is still a realistic scenario.

A severe vulnerability was fixed in the version 5.1.16 that the University had used. According to the description it allowed copying files to arbitrary places on the file system. That would probably make it relatively easy to completely take over an installation and execute code. This vulnerability was fixed in the version that was active until a few days ago, but according to previous reports the attack had started several months before it was detected in December 2017.

Administrator account with default Password "homer"

During the analysis of Ilias we found another weakness. After a fresh installation of the system a default account with administrator permissions is created. This is assigned the username "root" and the password "homer". The user is not asked to change the default password. Therefore it's possible that the default password was simply never changed.

We found no easy way to directly execute code with an administrator account, but of course it is possible that such a vector exists and we simply haven't found it.

It's also possible that the attack happened with a yet unknown vulnerability or with login data that was stolen via phishing. The Ilias system is quite extensive and has many possibilities for users to interact with it. File uploads of various media formats, a wiki, a plugin system and a lot of other features provide a large attack surface.

Approved by NATO

During our research we found a report from 2008. According to this, NATO tested the Ilias software for three days and didn't find any security flaws. Ilias can therefore be used in NATO's internal network Chronos. Also according to the report, Ilias was used by NATO to prepare soldiers for the ISAF mission in Afghanistan.

Please notice: The German version of this article can be read here.

 Government Hack: Hack on German Government via E-Learning Software Ilias
  2. 1
  3. 2

  1. ab 294,00€ lieferbar
  2. ab 304,90€ lieferbar
  3. (u. a. Dark Souls 3 11,99€, Little Nightmares 5,50€)
  4. 999,00€

hg (Golem.de) 12. Mär 2018

Wir haben in diesem Fall auch eine englische Version des Artikels gemacht, weil wir die...

Folgen Sie uns

Kingdom Hearts 3 - Test

Das Actionspiel Kingdom Hearts 3 von Square Enix bietet schöne und stimmige Abenteuer in vielen unterschiedlichen Welten von Disney.

Kingdom Hearts 3 - Test Video aufrufen
Marsrover Opportunity: Mission erfolgreich abgeschlossen
Marsrover Opportunity
Mission erfolgreich abgeschlossen

15 Jahre nach der Landung auf dem Mars erklärt die Nasa das Ende der Mission des Marsrovers Opportunity. Ein Rückblick auf das Ende der Mission und die Messinstrumente, denen wir viele neue Erkenntnisse über den Mars zu verdanken haben.
Von Frank Wunderlich-Pfeiffer

  1. Mars Insight Nasa hofft auf Langeweile auf dem Mars
  2. Astronomie Flüssiges Wasser auf dem Mars war Messfehler
  3. Mars Die Nasa gibt den Rover nicht auf

Klimaschutz: Energieausweis für Nahrungsmittel
Energieausweis für Nahrungsmittel

Dänemark will ein Klimalabel für Lebensmittel. Es soll Auskunft über den CO2-Fußabdruck geben und dem Kunden Orientierung zu Ökofragen liefern.
Ein Bericht von Daniel Hautmann

  1. Standard Cognition Konkurrenz zu kassenlosen Amazon-Go-Supermärkten eröffnet
  2. Amazon-Go-Konkurrenz Microsoft arbeitet am kassenlosen Lebensmittel-Einkauf

Carsharing: Regierung will Mobilitätsdienste per Gesetz stärken
Regierung will Mobilitätsdienste per Gesetz stärken

Die digitalen Plattformen für Carsharing und Carpooling sollen Rechtssicherheit bekommen. BMW, Daimler und VW sowie Uber & Co. stehen in den Startlöchern.
Ein Bericht von Daniel Delhaes und Markus Fasse

  1. Lobbyregister EU-Parlament verordnet sich mehr Transparenz
  2. Contract for the web Bundesregierung unterstützt Rechtsanspruch auf Internet
  3. Initiative D21 E-Government-Nutzung in Deutschland ist rückläufig

    •  /