MOVEit, a managed file transfer software product developed by Progress Software, employs Secure File Transfer Protocol (SFTP) to securely transfer and encrypt data at rest. The software has been popular with the healthcare industry as well as financial services and government sectors, but on May 31st, 2023, Progress Software disclosed a critical vulnerability: CVE-2023-34362.

Upon successful exploitation of this vulnerability, an attacker could gain sufficient access to install a web shell inside the MOVEit application. This would allow the bad actor full access to read, write and delete contents of the various databases it utilizes, such as MySQL, Microsoft SQL Server, and Azure SQL. Multiple vendors have published details about the attack vector, revealing a consistent pattern of attempting to infiltrate the vulnerable system via SQL injection to implant the web shell.

Read on to discover three ways Riverbed can help safeguard your organization from potential breaches.

1. Uncover historical activity

If you have unknowingly been scanned or implanted with this web shell, it is important to note that these attackers have been known to use a range of IP addresses. This range is released with the CVE Indicators of Notice. Thanks to Alluvio NetProfiler‘s high-resolution, raw-flow retention that comfortably goes back multiple years, the search through history to investigate any traces of offending IP addresses is made simple.

NetProfiler Flow Log Showcasing Retention Time Range

Simply copy and paste these IPs, set your desired time range, and then see whether there has been any activity from these IP addresses in the past.

NetProfiler Provided with IPs Inflicting MOVEit Vulnerability Scans

NetProfiler then provides detailed, highly-customizable interactive reports, such as report shown below, on the various TCP or UDP communication these IPs have been engaging. In easy to understand tables, it provides port number and traffic volumes.

Traffic Report in NetProfiler

2. Visualize relationships between IP addresses

Visualizing the relationships of IP end points will usually bring out hidden trends and patterns in the attack vector that may not be as easily apparent in reading reports and tables. NetProfiler provides dynamically-generated, interactive visualizations of the TCP/UDP communication with the attacker’s IPs.

Service Map Details NetProfiler

3. Track attack signatures from packets

Most attacks exhibit distinct patterns that can be captured through network activity analysis. In this case, the Indicators of Compromise (IOC) are specific HTTP headers present in the attacker’s requests:

• X-siLock-Comment
• X-siLock-Step1
• X-siLock-Step2
• X-siLock-Step3

Configuring the below definition for “Web Application” within Alluvio AppResponse ensures that even a single packet detected in the full bandwidth of data being analyzed by the appliance will trigger an event. Packets can be reviewed, and metrics for that TCP and HTTP exchange will be logged.

Detecting Attack Signature with AppResponse

Once the definition is in place, you can observe detailed packet-based metrics and access the actual packets through right-click functionality.

Details of Scanners Provided by Alluvio AppResponse

Here are some of the typical alerts that AppResponse offers, with numerous other categories available:

Alluvio AppResponse Alerts

Summary

In this blog, we explored how attack vectors follows common patterns to scan for vulnerabilities and how packet and flow-based monitoring tools can be used to analyze past incidents and detect ongoing scans and threats. To learn more about how Riverbed Observability tools can help you protect against malicious actors, please reach out to our experts here.