Hackers Exploit Default Credentials in FOUNDATION Software to Breach Construction Firms

Threat actors have been spotted attacking the construction industry by infecting the FOUNDATION Accounting Software, according to fresh findings from Huntress.

"Attackers have been observed brute-forcing the software at scale, and gaining access simply by using the product's default credentials," the cybersecurity business stated.

Targets of the developing danger include plumbing, HVAC (heating, ventilation, and air conditioning), concrete, and other associated sub-industries.

The FOUNDATION software comes with a Microsoft SQL (MS SQL) Server to manage database operations, and, in certain situations, has the TCP port 4243 open to directly access the database via a mobile app.

Huntress said the server has two high-privileged accounts, including "sa," a default system administrator account, and "dba," an account established by FOUNDATION, that are routinely left with unmodified default credentials.

A consequence of this change is that threat actors might brute-force the server and utilize the xp_cmdshell configuration option to conduct arbitrary shell commands.

"This is an extended stored procedure that allows the execution of OS commands directly from SQL, enabling users to run shell commands and scripts as if they had access right from the system command prompt," Huntress stated.

First evidence of the activity was spotted by Huntress on September 14, 2024, with roughly 35,000 brute-force login attempts logged against an MS SQL server on one host before achieving successful access.

Of the 500 systems running the FOUNDATION software across the endpoints secured by the organization, 33 of them have been determined to be publically accessible with default credentials.

To limit the danger presented by such assaults, it's suggested to rotate default account credentials, quit exposing the application over the public internet if practicable, and deactivate the xp_cmdshell option if suitable.