Project Raven USES default credentials
Project Raven gained initial access to a government VPN using default credentials.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“That VPN was using default credentials.”
Technique
technique:default_credentials
Also: default creds, default passwords, default usernames and passwords, root root
Use or discovery of unchanged administrative usernames and passwords to obtain initial access.
Use or discovery of unchanged administrative usernames and passwords to obtain initial access.
“That VPN was using default credentials”
“The default credentials on this platform, again default creds, are administrator/administrator.”
Attempting access with vendor or commonly used default usernames and passwords against exposed services.
“databases just left open with default credentials”
“he’ll try default usernames and passwords”
Use of an unchanged or trivial username and password combination to access the database.
“there was no password. It was ‘root root’”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Project Raven | Explicit | 47 |
| incoming | USES | GDI Foundation | Explicit | 88 |
| incoming | USES | Victor | Explicit | 88 |
| incoming | INITIAL_ACCESS_VIA | Vastaamo cyber attack | Attributed | 159 |
Project Raven USES default credentials
Project Raven gained initial access to a government VPN using default credentials.
Explicit Confidence 99% · Jack Rhysider EP 47 Details
“That VPN was using default credentials.”
GDI Foundation USES default credentials
GDI's vulnerability work included finding internet-exposed databases with default credentials.
Explicit Confidence 96% · Jack Rhysider EP 88 Details
“databases just left open with default credentials”
Victor USES default credentials
Victor tried default usernames and passwords when checking exposed databases.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“he’ll try default usernames and passwords”
Vastaamo cyber attack INITIAL_ACCESS_VIA default credentials
According to Ransom Man's forum statement, access to the database was easy because it had no password and used the credentials 'root root'.
Attributed Confidence 95% · Joe Tidy EP 159 Details
“there was no password. It was ‘root root’”