Exposed segment
How a router misconfiguration exposed a company’s internal network to the internet
How the attack unfolded
One router misconfiguration exposed the internal network to the internet, and outdated software let the attackers take over servers quickly.
Configuration error Entry point
A misconfigured border router
Segment exposed
An internal network segment gets public addresses and becomes reachable from outside
Network scanning
The attackers scan the exposed segment
Vulnerabilities found
Most systems run outdated software without security updates
Servers taken over
Many servers in the segment are compromised
Spread across the network Impact
Network links carry the attack into other segments
What we did
We found the misconfiguration that exposed the internal segment to the internet, reconstructed the attack and identified where defences failed. We handed over recommendations on network settings, updates and segmentation.
Task
Attackers compromised many servers in the company’s internal network and spread to other parts of the infrastructure. We had to work out how they reached the internal network in the first place and why the attack moved so fast.
Solution
- Found the cause: a misconfigured border router had made one of the internal network segments reachable from the internet.
- Checked the systems in that segment: most ran outdated software and received no security updates.
- Reconstructed how the attackers found vulnerable hosts by scanning and compromised the servers.
- Worked out which network links carried the attack into other segments of the infrastructure.
- Prepared a plan: fix the configuration, update the systems, separate the segments and check the perimeter regularly.
Where the attack could have been stopped
Mistakes like this are visible from outside: even a passive audit reveals them. We recommended:
- Change control for network settings: review router and firewall rules after every change
- Regular external scanning to see what the company has actually exposed to the internet
- Timely security updates and an inventory of outdated systems
- Segmentation: even an accidentally exposed segment shouldn’t give access to the rest of the network
- Monitoring of inbound connections and scanning attempts
What shall we build together?
Tell us what you want to launch or improve. We’ll discuss the task and suggest the next step.