file-encrypting Trojan

[taich]

I discovered a file-encrypting Trojan that encrypted a hole proxmox 6.4 server.
I have no idea how this can happen since nobody does ever physical work on the proxmox console.

 

[SOLTECSIS - Carles Munyoz]

Knowing which file-encrypting Trojan perhaps helps to solve the mystery.
Which one?

 

[taich]

Jungle_Sec
They want 0.4 Bitcoin to

 

[Dunuin]

Installing JungleSec through IPMI​

In conversations between BleepingComputer and two victims it was discovered that attackers installed the JungleSec ransomware through the server's IPMI interface. In one case, the IPMI interface was using the default manufacturer passwords. The other victim stated that the Admin user was disabled, but the attacker was still able to gain access through possible vulnerabilities.

Once the user gained access to the servers, which in both of these cases were Linux, the attackers would reboot the computer into single user mode in order to gain root access. Once in single user mode, they downloaded and compiled the ccrypt encryption program.

Did you always update your IPMIs firmware?

 

[SOLTECSIS - Carles Munyoz]

Did you always update your IPMIs firmware?

Maybe this can explain the infection.

Do you have PBS (Proxmox Backup Server) for recover the VMs?
We have customers with a PBS and backups every hour for minimize the consequences of infections like this.

 

[taich]

The mainboard is a supermicro 2 years old with latest firmware. The default password was changed but may be was brute force hacked.
Fortunately we do have a full backup and do not need to pay ransom of 0.4 BTC.

In the future we wont expose IPMI to the internet any more.

 

[tjk]

In the future we wont expose IPMI to the internet any more.

NEVER expose IPMI to the Internet, never ever ever.

 

[SOLTECSIS - Carles Munyoz]

NEVER expose IPMI to the Internet, never ever ever.

I agree with this, exposing IPMI to the internet is like leave your home's door open all the time.
It is better access IPMI using a VPN.

 

[oguz]

The mainboard is a supermicro 2 years old with latest firmware. The default password was changed but may be was brute force hacked.
Fortunately we do have a full backup and do not need to pay ransom of 0.4 BTC.

In the future we wont expose IPMI to the internet any more.

unfortunately IPMI security isn't in a good state, as the others have suggested it's better to access it over a VPN or similar.

make sure you also close udp port 623 for BMC Remote Management Control Protocol (RMCP) and not only the user interface of the IPMI (SSH can be a target as well if that is enabled)

it's likely that they gathered your IPMI HMAC hash (if they can guess your username, most cases this is left default or easily guessable like 'admin' or 'root') [0] and cracked it offline...

but at least you had backups

[0]: http://fish2.com/ipmi/remote-pw-cracking.html