The MOVEit Hack In Retrospect

John Hammond details the MOVEit Transfer exploitation by the Cl0p ransomware gang, highlighting how a critical SQL injection vulnerability led to mass data exfiltration and significant cloud security risks via Azure integration 3:05.

Key Takeaways:
• The attack impacted roughly 2,500 exposed servers and millions of individuals through the supply chain, with major victims including British Airways and Shell 4:14.
• Attackers used SQL injection to fabricate a session ID in the database, achieving authentication bypass without valid credentials 17:00.
• Researchers discovered the exploit chain went further, utilizing deserialization to achieve remote code execution (RCE) and full server control 18:46.
• The human2.aspx webshell included features to steal Azure storage keys, directly bridging the on-premise compromise to cloud security risks 21:18.
• Subsequent analysis revealed initial patches were incomplete, leading to the discovery of additional CVEs in MOVEit and critical vulnerabilities in WS_FTP 24:04.

Collaboration between researchers, CISA, and the vendor was vital to mitigate the threat, emphasizing the need for rigorous third-party security audits 32:00.

Sources:

• 3:05 Introduction to MOVEit Transfer and the incident context.
• 4:14 Discussion of the number of exposed servers and supply chain impact.
• 17:00 Explanation of the SQL injection authentication bypass.
• [18:46](https://www.youtube.com/watch?v=cuWGWnvnN