Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

Accounting software brute force attacks hit construction companies

A padlock resting on a keyboard.

Hackers are targeting construction companies with brute-force attacks, breaking into their networks and executing different commands remotely, experts have warned.

Cybersecurity researchers Huntress, who recently observed the attacks in the wild, noted cybercriminals are going after Foundation - a piece of software used by construction companies for accounting and project management. It helps manage financials, job costing, payroll, and reporting, and offers tools for tracking expenses, managing contracts, and staying compliant with industry regulations.

This software also has an accompanying mobile app, and in order for it to work properly, a Microsoft SQL Server (MSSQL) needs to be configured to be publicly accessible via TCP port 4243. This server has two admin accounts, and in many instances - users never changed the default passwords.

Running commands

Cybercriminals seem to have picked up on this information, targeting dozens of organizations with brute-force attacks, in an attempt to log into these accounts. In fact, Huntress spotted 35,000 attempts on a single host, within an hour. The researchers said they saw “active breaches” in organizations working on plumbing, HVAC, concrete, and similar.

After gaining access, the attackers try to enable features that allow them to run commands on the operating system. Some of the commands observed by the researchers were to retrieve network configuration details and pull information about the hardware, OS, and user accounts.

Huntress says that of all the endpoints it defends, 500 hosts were seen running Foundation, 33 of which had publicly exposed MSSQL databases with default admin credentials. The researchers notified the company of their findings, but Foundation said the problem only affects on-prem instances. In other words, software users should be the ones minding their security posture. The company did stress that not all servers have the same port open, and not everyone has the same default credentials.

Via BleepingComputer

More from TechRadar Pro

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.