Original-URL des Artikels: https://www.golem.de/news/government-hack-hack-on-german-government-via-e-learning-software-ilias-1803-133231.html
Veröffentlicht: 08.03.2018 17:46
Kurz-URL: https://glm.io/133231 Government Hack
Hack on German Government via E-Learning Software Ilias
The German government was hacked via the learning plattform Ilias, which is used at the government's own university. The university was using an old version with various security vulnerabilities.
Employees of the public administration in Germany can use educational programs on the webpage lernplattform-bakoev.bund.de - usually. But the webpage, which is operated by the University of the German government, is currently not available. Visitors only get an error message: "The learning plattform Ilias is currently unavailable. It was disabled due to a recommendation from the BSI." The BSI is the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik). It's this platform via which the hacker attack on the German government supposedly happened.
The BSI stated that is has no knowledge of security vulnerabilities in Ilias, the Ministry of Interior declined to make further comments. Golem.de has taken a look at the software.
The error message confirms previous media reports according to which an e-learning service of the government was the entry point for the malware attack. By modifying an online course the attackers were able to infect 17 computers of the Federal Foreign Office, as reported by the newspaper Frankfurter Allgemeine Sonntagszeitung. The attack was detected in December 2017, but it is supposed that it had already been active for several months at that point. Previous reports said that the German government was informed by a secret service of another country about the infected computers.
Although individual computers connected to the IVBB (Informationsverbund Bonn Berlin) network were compromised, there is no clear indication that IVBB network infrastructure was compromised. IVBB is the German government's secure network for communicating certain classified information. According to media reports security authorities believe the attack was of Russian origin.
Ilias confirms hack of its software
Ilias is an open source project, it is used at several Universities and other public institutions. It was developed by an organization located in Cologne. On the public administrators mailing list of Ilias the product manager Matthias Kunkel wrote on March 8th that "an Instalaltion of the Ilias-Software was supposedly involved" in the Hack of the network of the Government. However currently they have no detailed information about the used security vulnerabilities. The organization wants to discuss the issue at their developer conference next week in the city of Halle/Saale.
Answering a request from Golem.de Matthias Kunkel from Ilias commented on the software. He said: "The organization Ilias open source e-Learning e.V. publishes Ilias as an open source software and coordinates the software development. Yet the individual Ilias installations are operated by their corresponding institutions or companies that use Ilias for their e-learning purposes." The installation that was taken offline "is operated by the University of the German Government".
There are a number of security vulnerabilities that attackers could have used.
University uses old version with known Vulnerabilities
We could not find out how exactly the attack happened, because none of the involved institutions have given us a statement yet. An analysis of the software however brought up some details that may give a hint.
In our research we were able to see the version of Ilias on the affected web page via the Google cache. According to that the site was operated with Ilias version 5.1.16. This version was released a year ago in March 2017. Since then, many security updates have been issued that apparently weren't installed.
The upload of SVG files enabled a cross-site scripting vulnerability, another cross-site scripting vulnerability was found due to a lack of filtering of form inputs. In some situations, a flaw in the delivery of e-mails could cause the delivery of system mails to the wrong user. In October 2017 a vulnerability in the handling of media files was found, though no details about the impact were published. In early February 2018, another cross site scripting vulnerability was found.
Exploiting such vulnerabilities usually requires the attacker tricking the victim into clicking on a malicious link or accessing a specific portion of a site containing attacker-controlled code. This is usually more complicated to exploit than some other classes of vulnerabilities that allow immediate code execution or the extraction and manipulation of data. But for a professional attacker it is still a realistic scenario.
A severe vulnerability was fixed in the version 5.1.16 that the University had used. According to the description it allowed copying files to arbitrary places on the file system. That would probably make it relatively easy to completely take over an installation and execute code. This vulnerability was fixed in the version that was active until a few days ago, but according to previous reports the attack had started several months before it was detected in December 2017.
Administrator account with default Password "homer"
During the analysis of Ilias we found another weakness. After a fresh installation of the system a default account with administrator permissions is created. This is assigned the username "root" and the password "homer". The user is not asked to change the default password. Therefore it's possible that the default password was simply never changed.
We found no easy way to directly execute code with an administrator account, but of course it is possible that such a vector exists and we simply haven't found it.
It's also possible that the attack happened with a yet unknown vulnerability or with login data that was stolen via phishing. The Ilias system is quite extensive and has many possibilities for users to interact with it. File uploads of various media formats, a wiki, a plugin system and a lot of other features provide a large attack surface.
Approved by NATO
During our research we found a report from 2008. According to this, NATO tested the Ilias software for three days and didn't find any security flaws. Ilias can therefore be used in NATO's internal network Chronos. Also according to the report, Ilias was used by NATO to prepare soldiers for the ISAF mission in Afghanistan.
Please notice: The German version of this article can be read here.
Bundeshack: Hack auf Bundesregierung erfolgte über Lernplattform Ilias
Fluggastdaten: Regierung dementiert Hackerangriff auf deutsches PNR-System
Bundesregierung: 5G-Frequenzen nur bei flächendeckendem Ausbau
Active Directory: Samba-Nutzer können Admin-Passwort ändern
BeA: So geht es mit dem Anwaltspostfach weiter