Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Full System Control with New SolarWinds Orion and Serv-U FTP Vulnerabilities (trustwave.com)
91 points by wglb on Feb 5, 2021 | hide | past | favorite | 48 comments


Unauthenticated queue, with unsafe deserialisation, running as the system account.

Amateur hour


That’s almost as bad as the time Microsoft ran Defender sandbox as LocalSystem. CVE-2017-0290. That one was a massive dose of irony in one CVE.

You’d think people would have learned about least privilege by now?


It's why it's the preferred server in the warez scene


Do they still break into other peoples servers instead of renting their own?


I am assuming it is still like the old days. A sysadmin drops an ftp server onto some box/vm at a company and no one notices


Of course! Renting their own will make them easier to find


They could pay with a privacy-minded cryptocurrency though. Like Monero or something.


This same FTP server powers Dominion Voting Systems, which controls a huge share of the election infrastructure in the U.S.

https://dvsfileshare.dominionvoting.com/Web%20Client/Mobile/...


I poked around on Serv-U's customer testimonials. Lots of US Military, White House, various healthcare providers, etc. And they include specifics on customers too. Almost a ready made hit list. Ouch.


The FTP server bug is a really boring LPE, it really couldn't matter less.


Can you elaborate on why you think this is relevant?


I will elaborate on why I think it's relevant.

The election infrastructure for much of the country has the security of swiss cheese. And this isn't some new thing created from whole cloth by Trump supporters; people have been raising concern about this for years. Back when Obama was up for election, there were news articles about how election machines could potentially be tampered with to steal the election from Obama. When it was Trump vs Hillary, some were concerned the election would be stolen from Hillary, and when Trump was elected, insinuations and outright accusations were levied that Trump stole the election through, amongst other things, election machine tampering. And then in this most recent election cycle, we have the "Kraken", et. al., which appears to have, in-part, motivated the Capitol riot.

Regardless of what you think of the of the truth of the accusations, whether in this election cycle, prior ones, or future ones, the fact that the underlying (lack-of) security lends a plausibility to such accusations is a problem unto itself. If elections have or are tampered with by malicious agents, foreign or domestic, we do not have free and fair elections, and that's a Big Problem. If demagogues can easily stir up popular sentiment that the elections are not free and fair, that's also a Big Problem. It is the lack of election security that amplifies those problems into big ones.

Sure, we can go after entities that try to tamper with elections, and we would do well educate ourselves to be able to spot demagoguery and misinformation. But we would also do quite well to go after underlying problems that make the aforementioned problems worse.


The problem with electronic voting machines, is no matter how secure you make them, people find the narrative that they are insecure easily believable, regardless of whether the narrative is true or not in any particular case.

If you stick entirely to paper-based voting, you don't have that problem. Of course low-tech means of fraud still exist (stuffing ballot boxes, etc), but there are low-tech means of presenting that – you allow each candidate/party to send poll observers to watch the counting process.


Yep, I changed my view on electronic voting for this reason.

Even if we create a perfect, provable, electronic voting system, a very small percentage of the public is going to be able to understand the proof and even fewer will be able to verify for themselves. Most people will have to rely on experts to tell them if it is secure or not.

For voting, we need most people to be able to both understand why it is secure and be able to verify for themselves that it is. Paper ballots provide that, electronic voting doesn’t.


Electronic fast counting on deposit for in-person voting? Sure, but I like mail in a lot better.

I am OK with electronic printing of human legible votes; if you want to get fancy. (Fill the bubbles in fully)


There's always the issue of not being able to verify for oneself. We tend to trust video, but what if it's video of something tainted (or a straight up deepfake)?

If poll workers hand off ballots to separate counters, but publicly hired counters are diverted and provided with plausible decoys while poll workers actually hand off to secret actors who just capture and release video of the public counters... back to the Swiss cheese we go.


This is extremely difficult to pull off at scale without being caught.


This is the key. Hacking a traditional X-in-the-box and count-in-public ballot at scale is impossible. Yes I could go to a neighbouring ward and claim I'm Joe Bloggs and vote as him. That will work until he turns up later and they tell him he's already voted.

Do that once or twice and it may avoid press coverage. Do it a lot and it's going to get coverage.


That's why the CISA had a huge emphasis on paper backups in the election. You can't hack a physical printout which the voter verifies themself before scanning.


The QR code is scanned, not the text on the paper printout, as far as I understand


But the count can (and was in certain states) be verified with a hand recount of the paper ballots, which is not subject to digital interference.


Your right. It's complicated. The sad thing is, it doesn't matter. Simpler manufactured narratives will win in the future.


But how is a boring LPE related to election security?


Can you elaborate on why you think this isn’t relevant? It seems plainly obvious to me how it’s relevant.


Does the FTP server print out paper ballots which voters then review and manually scan in a machine? If not then it's totally irrelevant.


How do you think the tallied paper ballots get sent along after being scanned into a machine? FTP comes to mind...


They are physically transported to a central tabulation center on memory cards. The machines aren't connected to the internet.


Check out page 20 of this document [0] produced by Dominion. It clearly shows FTP being used to transfer tallied vote data from remote polling sites to central sites.

Do you have any evidence to support your claim?

[0] https://www.sos.state.co.us/pubs/elections/VotingSystems/sys...


Dominion works off of dongles and file transfers.

If you're curious about the DVS topology: https://www.sos.state.co.us/pubs/elections/VotingSystems/sys...


For early voting reports. Paper ballots are tallied for official results.

A vulnerability in the FTP software, which I don't believe you've provided any proof was actually exploited in the wild during the elections, makes 0 difference to official results.


They never claimed it was exploited in the wild nor that it affected the results of the 2020 US election .


I mean that was obviously the implication of the original comment in this chain.


No, no it wasn't. Like the previous poster (ficklepickle), I didn't read that the OPs post to mean that either.


Then what was the point of the comment?


With all of the controversy (real or imagined) surrounding the recent elections I think the company who makes the voting machines having an open exploit like this is a bad look.

No one is saying they were hacked this way but it definitely can be used as fodder to bolster election fraud claims (real or imagined.)


There is a deterrent disclaimer https://dvsfileshare.dominionvoting.com/

Access to this site is for authorized users only! All unauthorized use and access will be prosecuted to the fullest extent of the law.

I'd be carefull before trying anything on that server.

-edit: Added italic on the disclaimer


People that write such "deterrents" should dogfood their own stuff by replacing their door lock (or similar security measures - car keys, payment card PINs, etc) with such a disclaimer.


I like when the hackers make complete disc images on docker and let people download those

the hacker is the only one with any unauthorized access liability and all the other tinkerers have none from what I can tell


I didn't know, that serv-u is still a thing. Last time I heard that name was like 10-15y ago, before bittorrent became the big thing. :)


I was surprised too

Haven't heard that name back to warez days ~ 20 or years ago.

I remember when flashfxp became the rage to transfer between from dump sites


Those were the dayze.


the serv-u thing looks like a misconfiguration to me. i'd be curious how many installs in the wild are actually vulnerable. ie.

1) was there a previous install process that did set correct permissions for the access list tree?

2) did sites secure the access list tree themselves after install/security review?

the msmq thing isn't great, but any professionally managed site would be protecting/firewalling application level sockets anyhow.

not to say the bugs aren't real, they are, just wondering how much exposure they actually open up in the wild when combined with basic security hygiene.


My organisation uses Serv-U. The permissions in our programdata folder matches the article (we've not applied the most recent Serv-U patch which came out quite recently).

But as the article says you need to be RDP'd to the server which for us would be Administrators. Who already have control over the server. Also we don't run the service as local system just as a regular service account with no admin rights.

So while this is a vulnerability it doesn't seem overly critical in our case. If you let non-privileged users RDP to your application servers and you're running as local system then sure, it's pretty bad.


Their hotfix seems to acknowledge that the software is specifically setting weak ACLs on that C:\Program Data\RhinoSoft\Serv-U\Users directory.

You're right that end users should do "2)", but I imagine it's pretty common to just run the installer.


the name of the previous developer (rhinosoft) of the software appears in the directory tree, which would lead me to guess that maybe the original installer did set correct ACLs but when ported to the new post-acquisition solarwinds installer, that was maybe dropped. (just a guess)

i dunno how modern windows admin is done, but the last time i worked with it it was common for large sites to use deployment automation and do repackaging, even if was less sophisticated than what you'd see in unixland.



220 Serv-U FTP Server v6.3 for WinSock ready...

https://www.shodan.io/search?query=serv-u+ftp


Servu is still being used in the wild??? 1998 called and wants its tech back.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: