Iranian Hackers wiped out machines at Sands Corp Casino

Pierluigi Paganini December 13, 2014

Bloomberg revealed that Iranian hackers have used Visual Basic malware to wipe out data of corporate systems at Las Vegas Sands Corp.

On February 2014 the Casino operator Las Vegas Sands Corp suffered a major cyber attack, but only now the news was publicly disclosed by the Bloomberg Businessweek.

The attack has many similarities with the recent data breach occurred to the Sony Pictures and has caused serious damages to the company. Also in the case of the Casino operator Las Vegas Sands Corp, the attackers have compromised the company network, destroying thousands of servers and computers by wiping its hard disks with an aggressive malware.

Security experts believe that the hackers have operated a retaliation in response to the statement released by the chief executive officer of Las Vegas Sands Corp., Sheldon Adelson.

Sheldon Adelson is guilty to have made a statement against the Iranian Government in October 2013, the billionaire was at the Manhattan campus of Yeshiva University when he declared that a strike against the Iran was the unique way to definitively stop its nuclear program.

“What I would do,” Sheldon Adelson declared “would be to say, ‘Do you see that desert over there? I want to show you something.’ You pick up your cell phone and you call somewhere in Nebraska and you say ‘Ok let it go.’…Then you say, ‘See? The next one is in the middle of Tehran.”

The statement released by Adelson was transposed by Iranian Supreme Leader Ayatollah Ali Khameeni, who replied to the US Government with the following statement:

“slap these prating people in the mouth and crush their mouths.”

In December of the same year, the hackers hit the network of the Las Vegas Sands and the offensive continued also in January, when the attackers gained access to the company’s virtual private network gateway at its slots casino in Bethlehem, Pennsylvania.

“they found it: the login credentials of a senior computer systems engineer who normally worked at company headquarters but whose password had been used in Bethlehem during a recent trip. Those credentials got the hackers into the gaming company’s servers in Las Vegas. As they rifled through the master network, the attackers readied a malware bomb.” reported the post published by Bloomberg.

In February, the hackers compromised the Microsoft IIS development and staging server behind the website of the casino and used an open tool, dubbed mimikatz, to exfiltrate users’ credentials. The hackers discovered the credentials of a senior systems engineer who had visited the Bethlehem site from Las Vegas, then the attackers used them to compromise the corporate infrastructure and wipe out data on internal machines.

Las Vegas Sands Corp 2

The wiper malware used by the attackers was written in Visual Basic and it was able to completely erased data from the hard drives of the company.

“Typing from a Sony (SNE)VAIO computer, they compiled a small piece of code, only about 150 lines long, in the Visual Basic programming language. The program proved potent. Not only does it wipe the data stored on computers and servers, but it also automatically reboots them, a clever trick that exposes data that’s untouchable while a machine is still running. Even worse, the script writes over the erased hard drives with a random pattern of ones and zeros, making data so difficult to recover that it is more cost-effective to buy new machines and toss the hacked ones in the trash.” continues the post.

The hackers compromised the network and leaked the data online, including personal information, stolen email addresses and social security numbers of employees at Sands Bethlehem site.

The attackers also posted a message for the CEO of the Las Vegas Sands Corp:

“Encouraging the use of Weapons of Mass Destruction, UNDER ANY CONDITION, is a Crime, signed, the Anti WMD Team,” said one. “Damn A, Don’t let your tongue cut your throat,” warned another.

The company spokesman Ron Reese declined to comment on the details provided in the report published by Bloomberg:
“I’m not going to confirm anything that was speculated or written in the Bloomberg story.” said Reese .

The experts of Dell SecureWorks that were hired by the Las Vegas Sands Corp to sanitize the company systems declined to comment the incident, anyway security experts exclude the direct involvement of the Iranian Government and attributed the attack to a group of hacktivists.

Pierluigi Paganini

(Security Affairs –  Iranian Hackers, Sands Corp Casino)



you might also like

leave a comment