- The organization responsible for the hacks is called Klops and they have a website on the dark web where they list the companies they have targeted.
- The software being exploited is called MoveIT, which is used by many large organizations for secure data transfer.
- The hackers are demanding millions of dollars in ransom from the affected companies.
- The attacks have been ongoing for at least 2 years and are primarily targeting companies in the US and UK.
- The hackers claim to be a penetration testing service, but their motives seem to be financially driven.
- The vulnerabilities being exploited include a SQL injection vulnerability that allows unauthorized access to the MoveItTransfer database.

- SQL injection is still a prevalent issue despite people thinking it's outdated
- SQL injection involves sending SQL commands through a web form to a back-end database
- Sanitizing inputs is a way to prevent SQL injection, but attackers can find ways around it
- The Moveit software has vulnerabilities that allow attackers to gain access and exfiltrate data
- Shodan can be used to find systems vulnerable to SQL injection
- A proof of concept exploit has been developed for the Moveit software
- Reverse engineering the exploit is done by analyzing patches made to the software
- The video also discusses the basics of SQL injection and provides examples

- The web application Move It had a vulnerability to SQL injection due to the presence of commas between fields.
- The attackers exploited this vulnerability by inserting their own SQL statements and manipulating the database.
- They inserted themselves as users, created fake tokens, and updated IP addresses to bypass whitelisting.
- The SQL injection vulnerability was a result of improper sanitization of input data.
- The attackers spent years analyzing the code and likely used fuzzing techniques to discover and exploit the vulnerability.
- The comma in the SQL statement was the key to the exploit.
- Another similar SQL injection vulnerability was found in a different location within the Move It application.
- The second vulnerability allowed unauthorized access to the database.
- The second vulnerability was discovered by researchers and not being exploited in the wild.

- Researchers discovered a vulnerability in a code that has been exploited.
- Not everyone patches their software when new patches are released.
- Taiwan Semiconductor, the largest semiconductor foundry in the world, was hit by the exploit and may have to pay a ransom.
- The video highlights the importance of learning about real-world hacking examples, as opposed to dismissing them as unlikely.
- SQL injection attacks have become more sophisticated over time, requiring more advanced techniques.
- The video mentions advanced web app hacking and database hacking courses that cover SQL injection attacks, but the current exploit is considered state-of-the-art.
- The classic union statement in SQL can be used for stacking queries and accessing data, but it requires trial and error to get it right.
- The video mentions upcoming courses on SDR for hackers, AI for cybersecurity, Bitcoin forensics, Android hacking, building a femtocell, and analyzing the SS7 flaw in the cell system.

- The speaker designs classes based on their own interests
- They are grateful for the information shared on YouTube
- Bitcoin tracing is a requested topic
- Viewers are encouraged to suggest topics for future videos
- The speaker appreciates Occupy the Web's knowledge and experience
- The speaker thanks Occupy the Web for putting the video together quickly
- The current attack being discussed is described as mind-blowing and earth-shattering, but such occurrences are common in the industry.

- Klops is an organization responsible for hacks and demands ransom from targeted companies.
- MoveIT, a software for secure data transfer, is being exploited by the hackers.
- The attacks have been ongoing for at least 2 years, primarily targeting US and UK companies.
- The hackers claim to be a penetration testing service, but their motives are financially driven.
- SQL injection vulnerabilities in MoveIT allow unauthorized access to the database.
- The hackers manipulated the database by inserting SQL statements and bypassing whitelisting.
- The vulnerabilities were a result of improper sanitization of input data.
- The attackers spent years analyzing the code and likely used fuzzing techniques to exploit the vulnerabilities.
- Taiwan Semiconductor, the largest semiconductor foundry, was affected by the exploit.
- Learning about real-world hacking examples is important, as SQL injection attacks have become more sophisticated.
- The video mentions upcoming courses on various hacking topics and encourages viewer suggestions.
- The speaker appreciates Occupy the Web's knowledge and thanks them for putting the video together quickly.

This is a real world demonstration of the SQL Injection attack used in the recent MOVEit hack. This is real world - not just a simple SQL attack.
Big thank you to Juniper Networks for supporting the community and making this training free (and sponsoring my channel). Go to https://juniper.net/davidbombal to get lots of training and also learn how to get certified for $50 (Associate Level). Use this voucher code to register for your courses: DAVIDBOMBAL

If you have issues with the Juniper registration, please use these links that they gave me:
For Login assistance link https://userregistration.juniper.net/loginassistance
Customer Support link- https://support.juniper.net/support/requesting-support/
 
// Mr Robot Playlist //
https://www.youtube.com/playlist?list=PLhfrWIlLOoKNYR8uvEXSAzDfKGAPIDB8q

// Proof of Concept //
Horizon3: https://www.horizon3.ai/moveit-transfer-cve-2023-34362-deep-dive-and-indicators-of-compromise/

// David's SOCIAL //
Discord: https://discord.com/invite/usKSyzb
Twitter: https://www.twitter.com/davidbombal 
Instagram: https://www.instagram.com/davidbombal 
LinkedIn: https://www.linkedin.com/in/davidbombal 
Facebook: https://www.facebook.com/davidbombal.co 
TikTok: http://tiktok.com/@davidbombal
YouTube: https://www.youtube.com/davidbombal 

// Occupy The Web social //
Twitter: https://twitter.com/three_cube

// OTW Discount //
Use the code BOMBAL to get a 20% discount off anything from OTW's website: https://davidbombal.wiki/otw

Direct links to courses:
Pro Subscriber: https://davidbombal.wiki/otwprosub
3 year deal: https://davidbombal.wiki/otw3year

// Occupy The Web books //
Linux Basics for Hackers: https://amzn.to/3JlAQXe
Getting Started Becoming a Master Hacker: https://amzn.to/3qCQbvh
Top Hacking Books you need to read: https://youtu.be/trPJaCGBbKU

// Other books //
The Linux Command Line: https://amzn.to/3ihGP3j
How Linux Works: https://amzn.to/3qeCHoY
The Car Hacker’s Handbook by Craig Smith: https://amzn.to/3pBESSM
Hacking Connected Cars by Alissa Knight: https://amzn.to/3dDUZN8

// Occupy The Web Website / Hackers Arise Website //
Website: https://www.hackers-arise.com/?afmc=1d
OTW Mr Robot series: https://www.hackers-arise.com/mr-robot

Want to learn more from Occupy the Web? You can join his classes using these links:
Hacker's Arise Pro Subscription"
https://hackers-arise.com/online-store/Member-PRO-p444073646/?afmc=1d

Get 3 year's access to all live courses:
https://hackers-arise.com/online-store/Become-a-Hackers-Arise-Subscriber-3-years-of-training-p134507114/?afmc=1d

// MY STUFF //
https://www.amazon.com/shop/davidbombal

// SPONSORS //
Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com

// MENU //
00:00 - Coming Up
00:55 - Juniper Free Training (Sponsored segment)
01:51 - OccupyTheWeb books and new books
03:57 - The MOVEit breach explained
05:20 - Clop website // Companies affected
08:52 - The two different vulnerabilities
10:26 - The truth about SQL Injection
12:21 - Using Shodan
14:05 - Proof of concept of the exploit
16:18 - SQL Injection example
20:35 - MOVEit hack analysis / How it was done
28:57 - CVE-2023-35708 SQL Injection vulnerability explained
30:36 - What is Taiwan Semi-Conductor (TSMC) and why they got hacked
31:01 - SQL Injection hack in the real world
32:45 - OccupyTheWeb online classes
33:46 - Union statement // Stacking queries demo
37:02 - Upcoming OccupyTheWeb courses and classes
39:50 - Conclusion

MOVEit
sql
sql injection
hack
hacking
hacker
pegasus
cybersecurity

Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! 

Disclaimer: This video is for educational purposes only. 

#hacking #cybersecurity #sql

If I can just get past their firewall, we might have a chance.

The organization who has been executing these hacks is a company, a group known as Klops.

And they have a website on the dark web where they keep track and they show you who they pack.

So this has been, now it has been exploited, but Moobit or Progress is trying to get everybody to patch, but as we know, not everybody patches when new patches come out.

Since the attack has come out, we have a proof of concept that has been developed.

This is a proof of concept of the exploit.

I've got it over here in Kali, here it is.

You can get free training using the link below.

Go to juniper.net forward slash David Bombal and get free networking training, free security training, DevOps training, a whole bunch of other training for free from Juniper.

Not only do you get free training, but if you go through their assessments, you can get a discount on your exam and you can get certified for $50 at the associate level for example.

I really want to thank Juniper for sponsoring my channel, really want to thank them for creating this free training and making it affordable to more of us.

Many of you have told me that it's difficult to pay for some of the training out there, but here's your chance.

You can get free training from Juniper and by going through an assessment, you can get your exam for a very good price, $50.

I love it when big companies support the community and help educate and change lives.

Everyone, David Bombal back with Occupy the Web.

It's always good to be on the best IT and cybersecurity channel on YouTube.

I really appreciate you saying that, Occupy the Web, and you are 1 of the big reasons that people love my channel.

I'll just say this for everyone who's watching, I was on Reddit the other day and Someone commented about, David's YouTube channel isn't so good, but what keeps it good is Occupy the Web.

So Occupy the Web, thank you for making my channel great.

I enjoy it, it's always a good time with you, David.

So just for people who haven't seen our previous videos, he's the author of this book, Linux Basic for Hackers, fantastic book.

Also, network basics for hackers, as well as getting started becoming a master hacker.

Occupy the web, I know you don't like to give timelines, but I've had people say, when is your new book coming?

So you're hopefully we're gonna see another book from you at some point, right?

Probably see 2 new books from me next year in 2024.

The 1 that I keep on getting questions about is the Cyber Warrior Handbook.

And that 1 probably be coming in late 2024.

It's going to be based upon a lot of our experiences in Ukraine.

What kind of techniques, what kind of hacks did we use in Ukraine and what other cyber warriors can use in the future.

We hope to have some updated, editions of the other books as well coming out.

So I'm, I'm working on, I'm working on it.

It's it's, It's, you know, a lot of people think that, you know, writing a book is a quick and easy process, but it takes, it takes time and you have to work with editors and, you know, and, and companies who then publish them.

And sometimes, you know, it, it, it's a year between finishing a book and actually having it published.

don't know where you get the time because you're doing so many other things as well.

So I really appreciate you taking the time to share your knowledge on YouTube.

And I believe today we've got like a really interesting topic that's very fresh.

So as I said offline, I wanna keep quiet and let you take us on this journey.

So MoveIT, I believe is what it's about, right?

Yeah, MoveIT is the software that is a file transfer software that's used by a lot of large organizations around the world.

And it's been hacked and it's compromised a lot of companies.

Well, this morning, okay, we saw Taiwan semiconductor got hit with it.

And the list of companies is really, really long.

I could just name just a few Siemens, Schneider Electric, UCLA, Aer Lingus, BBC, British Airways, and many, many more.

And so I think we're up to about 150 companies that have been hit and this is still taking place.

I can show you the, well, the organization who has been executing these hacks is a company, a company, a group, known as clops, you know, and they have a website on the dark web where they keep track and They show you who they pack.

And if you want, I can show you their website.

And they have a long list of companies that they've hit.

And this is kind of their, it's, it's a Russian language web, Russian language group who's doing this.

We've got a lot of emails about government data.

We don't have any government data, anything directly residing on exposed or bad protected, not encrypted file transfer.

These, these guys are Russian language, native speakers, and they've been very effective.

You know, we've talked on here before about real live hacks that sometimes take weeks, months, years.

It's apparent that these guys have been working on this for at least 2 years, 2 years to be able to execute this.

We see them scanning these sites as of 2 years ago.

I think it was July, 2021, is the first time we saw them scanning sites.

So they've been working on this for at least 2 years.

1 of the things that they say here is that I find kind of humorous, is that they say, we are a penetration testing service.

So they're calling themselves a penetration testing service.

We are only financially motivated and do not care anything about politics.

Now, I find that a little disingenuous, maybe, is the best word for it.

When somebody says they're not interested in politics and explicitly states that, I question that.

Because 1 of the things that we note is that the focus of these attacks are against companies in Britain and companies in the US, both of whom are major supporters of Ukraine in the war with Russia.

And this is a Russian hacking group, right?

And basically they are a ransomware organization, but in this case, they don't look like they're ransoming.

They're more extorting money from the organizations.

They're saying, we've got all your data, unless you pay us, we're going to reveal all of your credit card information, personal identifiable information of your customers.

In the case of Taiwan Semiconductor, it looks like they may actually have intellectual property that is important for Taiwan Semiconductor, who is the largest boundary of semiconductors in the world.

You can see down below, it says, we see BBC decide to take what we told them in email and like what most media do, twist it to their own interest.

So here's kind of instructions they give the people who they've hit about what they need to do to be able to avoid.

And basically they're extorting money out of companies.

And this is a piece of software that's mostly used by very large organizations to be able to transfer data safely, they thought.

Supposedly, safely between different cloud organizations, cloud groups.

I like that they signed it off as friendly clop, friendly clop here at the bottom.

long as you pay us millions of dollars in ransom.

I think they're asking $70 million from Taiwan Semiconductor as of this morning.

And like I said, they've been working on it at least 2 years.

There's at least 2 different vulnerabilities involved in here.

And there's 1, the first 1 was CVE 2023-34-362, and then there's CDE 2023 35708.

In progress, move it transfer before 2021 06.

A SQL injection vulnerability found in the MoveItTransferWeb application that could allow an unauthenticated attacker to gain access to MoveItTransfer database.

Depending on the database engine being used, you see people are using various databases, MySQL, SQL Server, Azure.

They can basically take over and move the data to wherever they want.

And they can get themselves sysadmin privileges as well as then put in remote code execution.

They can put their own remote code into it and exfiltrate the data from the database.

This is, you can see it's a severe, severity is very high, Okay, 9.8 right here.

That's about as high as you can go, you go to 10.

It's interesting because a lot of people would say on YouTube, you know, SQL injection is old school.

No one's gonna use it anymore, but here's an example of it just being used.

They say, hey, you know, SQL injection was nobody uses that anymore.

SQL injection has been around since the beginning of the web.

And so when if you have gone through a cyber security class or a hacking class, they probably demonstrated a really simple SQL injection where you can send SQL commands.

So let's talk about what SQL injection is.

SQL injection is sending SQL commands through a web form okay to the back-end database.

As you know almost every website has a back-end database and this MySQL is probably the most popular, the open source database that's now owned by Oracle.

The way to prevent SQL injection is to basically sanitize the inputs.

So that means that you don't allow SQL commands to go to the back-end database.

And in some cases, you don't allow any of the SQL special characters or SQL keywords go to the back-end database.

But there's ways of getting around it and that's what these folks did.

They looked at the code and they were able to figure out ways to get around that sanitization process.

And so they were able to send some SQL commands into the database that basically gave them, they added themselves in as an admin user in the database.

And then once they're as admin they can do whatever they want.

It might be interesting to take a look at Shodan to see how many of these systems there are in the world.

Showdown is a website that cat it catalogs all of the banners that websites and ports on, on the websites present to themselves.

And you can find an awful lot of interesting stuff on it.

So we can go and we're using the the Favicon to be able to identify it and so these are there's 2,000 systems that are still connected now as of a few days ago was 2,500.

There's at least 2 ways to be able to find these websites.

1 of them is using the Favicon that's specific to that particular piece of software.

And of course you could also just put in Moveit, right?

And that'll reveal about 500 in the header.

These are the guys who just got hit recently, Siemens Energy.

And these are the companies who are using Moveit.

Moveit, there's Moveit, Moveit, Transfer, SFTP.

These are the companies who are using Moveit.

Now, Moveit or Progress Software has gone ahead and put out some patches, but it seems like every once a week we find, or they find, and other people find more vulnerabilities in the software that allows CLOP to be able to take over these websites and exfiltrate, you know, terabytes of data that they can then use and hold for ransom from these companies.

You're not going to find small companies using this.

It's mostly, you can see some of the organizations listed here.

This is how Klopp is finding their targets, is 1 of the ways they're finding their targets.

They're simply looking it up in Shodan and some of the other search engines they can find and we're seeing there's still a lot of them.

Since the attack has come out we have a proof of concept that has been developed and let me show you that.

It's a, I don't know how many lines, 300 lines or so.

And you can see that there's a some SQL injection right here and they're basically inserting into the database some tokens to give them access.

It says create our SQL injection statements right here.

Now generally when people think about SQL they're usually thinking about some select from where statements.

This allows them to insert themselves as a user and even a privileged user on the site.

And once they have privileged users they can log in.

You can see it allow logins with an external IP.

Okay insert into host permits and then going ahead inserting themselves to permit their IP address.

And it's kind of just some interesting analysis on the web by Horizon, AI3, I think is the name of the company, and Huntress and a few others.

I think also Rapid7 has done some good analysis of the exploit.

1 of the things that they did, and oftentimes what we do to be able to determine how an exploit works, is you simply take a look at the code, the move it code, both before and after the patch.

So those of us who are on the outside who are privy to what's actually going on, you can simply look at the code before a patch and after the patch and see what the differences are.

And then once you see what those differences are, then you can recreate the exploit and that's what basically where this comes from right here is that this proof of concept comes from basically reading the patches.

So when we see how the company tried to close the vulnerability, we can see what they did and then recreate the exploit.

This is basically recreating the exploit or reverse engineering the exploit based upon looking at the patch that was built for this particular exploit.

1 of the things you know that you're often taught in in SQL injection, let's see what we want we forgot I've got a little database up here this is DbBeaver it's a It's a GUI for working in databases in Kali and in other Linux distributions.

But generally, when you talk about a SQL injection, what they'll teach you is to do something that goes select.

I'm just going to write a few simple SQL statements.

So generally what they'll teach you is something like this.

And then a table name, say, you can see this is a sample database over here.

So it's select star from say album right okay and then where artist ID let's go name where let's change it to instead of album we'll change it to artist just to make it more interesting.

We're artist and we'll go name is equal to whatever.

Right, we could go let's go ahead and let's take a look at this database just so we can put together some examples.

Here's some of the people who are in that database.

Let's try something that's Aerosmith is easy to go ahead and we're going to go where.

I was just thinking of that as an easy name.

Where name is equal to, and you got to use the, when you're talking about text, it has to be in single quotation marks in, let's go arrow, when you're talking about SQL.

Then you can go ahead and just go and hit Enter.

Here we have, this is a simple select statement, it's called a query in SQL.

What we've done is simply asked the database for this particular, so select all the columns to star from the table artists.

You can see the artists over here where name is equal to Aerosmith.

Now, typically in when people are teaching how to do SQL injection, What they'll do is they'll throw in dash dash.

So this means that everything that comes after it is not seen by the database.

And this would be actually sending this back through a form.

And I'm just gonna show you the classic SQL injection and then what these guys did, which is really quite different and quite advanced.

So here, This is the classic 1 that's taught in all hacking cybersecurity classes.

So here's a login form where it's asking us for a name and a password.

What happens is that 1 can go ahead and put in their name and then use a single tick to close because the form has a single tick on its side, right?

You have to close the single tick and then go or.

Now this is a logical or, So it has to be either OTW is a user in the database, or 1 is equal to 1, which is always true.

And then dash dash, which means that everything that follows after it is going to be ignored.

This is the classic that is used, you know, everywhere to teach SQL injection.

Now, if I were to be able to, if I'm building a web application, and I don't want SQL injection to take place, what I will do is I will try to strip out these ticks and these dash dash, what have you.

So they don't get past the form into the database.

Unfortunately, what happened is that In the case of Move It, they left the ability to put commas between the fields, okay, commas between the fields, and the CLOP folks were able to exploit those commas by stripping out the commas and being able to do their own injection.

And these are the folks who were 1 of the first to come out with a good analysis of it.

And here you can see the path to SQL injection.

So path to the vulnerable user, get users with email address.

That is the function that has a SQL in it that they are able to exploit.

And what they were able to do, okay, here's the email address here, is that the function goes ahead and allows them to put, here it is right down below here, select username, and you can see if you look closely that there are some commas, there's commas between the fields right here, and what they did was able to exploit that, You can see it says right here, it says the part of the query and email, okay, has been uncleaned argument, meaning that they didn't strip out and sanitize the input.

The only caveat is this injection is that prior to the call, the self provisions receipts variable is split on commas.

Our injected SQL statement should avoid having commas to continue proper execution.

We can work around needing commas by reusing the SQL injection several times to do sequential statements such as insert and update.

Now as we see over here in the proof of concept, here we go back here, that's what they're doing here is that they're going ahead and doing inserts and updates to the database and they're inserting themselves into the database.

They've created a fake token and then they've inserted there.

You can see right here, insert into token ID values, token ID, And then they've updated the user external tokens.

And then they've gone ahead down below and inserted into the database, their IP addresses that this is a system that has white listed IPs.

That means that they only allow certain IPs to connect to this application.

So what they've done is go ahead and put in their own IP addresses so that it permits them to access this data that's built into these cloud-based database services.

And so this is a pretty sophisticated, took a fair amount of time for them to be able to find the SQL injection vulnerability.

This is an example of improperly sanitized SQL, where they tried to strip out any of the special characters but they missed 1 and as a result they were able to exploit this.

But once again this is years of work of trying to analyze this code to be able to find this 1 flaw in the way that they took the data that's input through the form and then sent it back to the database.

So almost every form, every form, we probably say pretty close to every form, has to take the data that you put into the form and send it back to the database, whether it's authentication or you're like searching for a product or you're searching for a particular customer.

When you go ahead and do a search on the form to be able to find a customer or a product, then that's taking that information that you have put input into the form and then taking that and putting it into a SQL statement, SQL query, and pulling the data off the database and showing you, oh, here's the products that all meet that criteria.

Here are the customers that all meet that criteria.

In the old days, it was pretty easy to be able to do SQL injection, the classic 1 just using that 1 is equal, 1 is equal to 1 and using the dash dash.

But now people have gotten pretty sophisticated and are stripping out all of that sequel special characters, but Occasionally they make a mistake.

And here's an example of where they made the mistake.

And as a result, we have millions of dollars worth of extortion or ransom that's being paid to this particular Russian-speaking group.

Now, we say Russian-speaking group doesn't necessarily mean that they're Russian.

It could be there's many countries where Russia is still a primary language and many people, for instance, in Ukraine speak Russian.

And all the other Russian republics who are now free countries, Russian is still the dominant language.

But we don't know where these guys are from.

The US government has offered a $10 million bounty to be able to identify them.

This is an example of somebody spending years and years analyzing code to be able to find, and in this case, they probably didn't have the code itself.

See all David Bombal transcripts on Youtube

Real World Hacking Demo with OTW