Full Report
Threat actors have been successful in gaining entry using accounting software commonly used by construction companies.
Analysis Summary
# Incident Report: Exploitation of FOUNDATION Accounting Software Default Credentials
## Executive Summary
In September 2024, threat actors launched a large-scale brute-force campaign targeting FOUNDATION Accounting software, widely used in the construction industry. Attackers leveraged exposed MSSQL instances (Port 4243) and default administrative credentials (**sa** and **dba** accounts) to gain entry. Once inside, they utilized the `xp_cmdshell` stored procedure to execute arbitrary OS commands, facilitating host and domain enumeration.
## Incident Details
- **Discovery Date:** September 14, 2024
- **Incident Date:** September 14, 2024 (Active intrusions observed)
- **Affected Organization:** Multiple (Unspecified)
- **Sector:** Construction (Plumbing, HVAC, Concrete, etc.)
- **Geography:** Global / North America (implied by software market)
## Timeline of Events
### Initial Access
- **Date/Time:** September 14, 2024, beginning at 11:24:45 UTC (Logs) / 15:38:35 UTC (Detection).
- **Vector:** Credential Brute Force / Default Credentials.
- **Details:** Attackers targeted MSSQL instances exposed to the internet on TCP port 4243, intended for mobile app connectivity.
### Lateral Movement
- **Details:** Following access, attackers executed system commands (`cmd.exe`) to perform host and domain enumeration, preparing for further movement within the target networks.
### Data Exfiltration/Impact
- **Details:** The specific extent of data exfiltration was not detailed in the report, but attackers gained the ability to run shell commands as a system administrator, providing full access to the accounting database and the underlying server.
### Detection & Response
- **Discovery:** Huntress SOC observed suspicious host/domain enumeration commands spawning from the `sqlservr.exe` process.
- **Response Actions:** Identification of the common attack vector (FOUNDATION software) and notification to affected clients to rotate credentials and close firewall gaps.
## Attack Methodology
- **Initial Access:** Brute-force attacks against MSSQL services exposed on port 4243; exploitation of default **sa** and **dba** account credentials.
- **Persistence:** Not explicitly detailed, but typically achieved via web shells or new account creation once `xp_cmdshell` is enabled.
- **Privilege Escalation:** Use of default administrative database accounts (**sa**) which have high-level system permissions.
- **Defense Evasion:** Not detailed; however, the use of legitimate administrative tools like `xp_cmdshell` often blends with administrative activity.
- **Credential Access:** Brute-forcing of known default passwords for the FOUNDATION software suite.
- **Discovery:** Host and domain enumeration via `cmd.exe` spawned from the SQL process (e.g., `ipconfig`, `net view`, `systeminfo`).
- **Lateral Movement:** Scripted commands across multiple companies within minutes.
- **Impact:** Potential for complete data theft of sensitive construction accounting data and full server compromise.
## Impact Assessment
- **Financial:** High risk due to the nature of accounting software (payroll, vendor details, bank info).
- **Data Breach:** High risk; administrative access to the primary financial database.
- **Operational:** Disruption to construction projects and back-office operations if databases are encrypted or wiped.
- **Reputational:** High risk for contractors handling large-scale commercial or government projects.
## Indicators of Compromise
- **Behavioral indicators:**
- `sqlservr.exe` spawning `cmd.exe` or `powershell.exe`.
- Execution of `EXEC sp_configure 'xp_cmdshell', 1`.
- Repeated failed login attempts in MSSQL `ERRORLOG` (up to 35,000+ attempts observed per host).
- File path: `C:\Program Files (x86)\Foundation\ServerConsole3000`.
## Response Actions
- **Containment:** Blocked external access to TCP port 4243 at the firewall level.
- **Eradication:** Rotation of **sa** and **dba** passwords. Disabling `xp_cmdshell` via SQL configuration.
- **Recovery:** Restoration of secure configurations and auditing of SQL logs for unauthorized data access.
## Lessons Learned
- **Key takeaways:** Default credentials in industry-specific software remain a primary target for automated brute-force attacks.
- **Gaps:** The exposure of database ports directly to the internet for mobile app functionality without a VPN or zero-trust gateway creates a significant attack surface.
## Recommendations
- **Rotate Credentials:** Immediately change default passwords for all MSSQL accounts (**sa** and **dba**).
- **Network Hardening:** Cease exposing the FOUNDATION application/MSSQL port to the public internet. Use a VPN or Restricted IP Whitelisting.
- **Configuration Management:** Disable `xp_cmdshell` on all SQL servers unless strictly necessary for business operations.
- **Monitoring:** Implement monitoring for suspicious subprocesses originating from database engines.