The username and passwords, as well as lots of other sensitive information, for more than 900 Pulse Secure VPN enterprise servers have been published online by some unidentified hacker.
The details were posted on a Russian-speaking hacker forum that is frequently visited by several cybercrime groups involved in ransomware activities.
In addition to user credentials, the list also includes the following details:
- IP addresses of Pulse Secure VPN servers
- Firmware version of VPN server
- SSH keys for each server
- Local users and their password hashes
- Details of admin account
- Last VPN logins (with details of usernames and cleartext passwords)
- VPN session cookies
Great (and bad news) story here, link in thread. Somebody has posted huge list of SSL VPN credentials for companies across world. https://t.co/UDocATZ2Vl— Kevin Beaumont (@GossiTheDog) August 4, 2020
Bank Security, a threat intelligence firm specialised in financial crime, told ZDNet that all the Pulse Secure VPN servers, whose details have been given in the list, were running a firmware version vulnerable to the CVE-2019-11510 security flaw.
The firm said that the attackers likely scanned the internet IPv4 address space for Pulse Secure VPN servers and then exploited the CVE-2019-11510 flaw to gain access to vulnerable systems. Then they collected all the information from compromised systems and placed the details at one central repository.
CVE-2019-11510 is a critical arbitrary file disclosure vulnerability existing in Pulse Connect Secure, the SSL VPN solution from Pulse Secure. The vulnerability was revealed last year and received a rating of 10 out of 10 on the Common Vulnerability Scoring System (CVSS), suggesting that a remote, unauthenticated attacker can easily exploit it to steal confidential information, such as usernames and passwords, from vulnerable endpoints.
While a patch for the vulnerability was released in April 2019, the bug garnered more attention after a proof of concept (PoC) for it was made public in August 2019. Soon, reports started to surface that hackers were scanning internet in search of vulnerable endpoints and then trying to exploit the bug.
In February, researchers from Bad Packets said that they had discovered nearly 2,500 Pulse Secure VPN servers worldwide that were still vulnerable to CVE-2019-11510 critical security flaw. The US topped the list with 718 vulnerable servers, followed by Japan with 332, and UK with 149 vulnerable VPN servers.
Earlier this year, it also emerged that currency exchange specialist Travelex, who suffered a massive ransomware attack in December, was already warned in September 2019 about insecure VPN servers that the firm was running. But, the warning was likely ignored by the company.
The Florida State Attorney's office is handling the prosecution of a 17-year old boy for his role in the Twitter hack that affected accounts including those belonging to Bill Gates and Elon Musk
Spear-phishing attack enabled attackers to access 130 accounts on the social media platform
125 organisations in the UK have contacted the ICO in relation to data breach
Data published online after service provider refused to pay ransom
A patch addressing the bug was released last month