Major International Airport System Access Sold for $10 on Dark Web

Researchers from the McAfee Advanced Threat Research team began with an open search on Russian RDP shop UAS to make their discovery.

Dark Web marketplaces are troves of illicit products and data: stolen credentials, credit card numbers, and, as researchers recently discovered, remote desktop protocol (RDP) access to the security and building automation systems of a major international airport – for the cheap price of $10.
Researchers from the McAfee Advanced Threat Research team used an open search on Ultimate Anonymity Service (UAS), a Russian RDP shop, to search for open RDP ports at that specific organization. They narrowed their search from 65,536 possible IPs to three; by obtaining a complete IP address, they could look up the WHOIS data and find all addresses belonging to a major airport, the name of which is being withheld.
RDP is a proprietary protocol developed by Microsoft to let someone access another machine via graphical interface. Its intended for use by system admins but can be dangerous when attackers use it as an entry point. The recent
SamSam ransomware campaign
against American businesses is one recent example in which attackers spent $10 for access to a machine and demanded $40,000 in ransom. The actors behind SamSam continue to advance and spread the attack.
RDP shops serve as the foundation for major cyberattacks, reports McAfee, whose researchers scanned several RDP shops selling anywhere between 15 to more than 40,000 connections, the latter of which they discovered at UAS, the largest shop in their research.
RDP access provides a route to target systems without phishing, malware, or an exploit kit. Top use cases for RDP access include spam campaigns, cryptomining, ransomware, planting false flags to disguise illegal activity as coming from a victims machine, and pilfering system data for identity theft, credit card fraud, account takeover, extortion, and other malicious use cases.
Its a useful protocol, says McAfee chief scientist Raj Samani, pointing to the benefits of RDP. But unless its locked down, there are concerns whereby anybody with an IP address and login can get access to this particular environment.
RDP shops sell entry to systems that are accessible via port 3389 – the RDP port – due to an issue like misconfiguration or missing two-factor authentication, Samani explains. Systems are advertised with their IP address, country, state, ZIP code, bandwidth, and date of addition. Price varies anywhere between $3 and $20 depending on bandwidth; the type of business is not a factor. Attackers simply have so much access they dont have time to figure out where it all leads.
Theyre not going through and looking at the impacted organization, Samani continues. Theyve got so much of this [data] that its economies of scale.
Further open-source searches revealed user accounts including an administrator account and two accounts associated with two companies specializing in airport security (building automation and video surveillance and analytics). Researchers also found a domain likely associated with the airports automated transit system.
Its troublesome that a system with such significant public impact might be openly accessible from the Internet, writes John Fokker, head of cyber investigations for McAfee Advanced Threat Research, in a blog post
on their findings
.
Researchers also found RDP access being sold to multiple government systems, including those linked to the United States, and dozens of connections to healthcare institutions, such as nursing homes and medical equipment suppliers.
This is not finding a piece of hay in a haystack, Samani says. This is a business, a huge business that is selling access to organizations and systems all across the world.
To protect their organizations from this level of vulnerability, security managers are advised to take a few precautions: Use complex passwords and two-factor authentication to make brute-force RDP attacks harder to complete; dont allow RDP connections over the open Internet; block IPs after too many failed login attempts; and regularly check for unusual entry attempts.
Related Content:
Microsoft July Security Updates Mostly Browser-Related
Ticketmaster Breach Part of Massive Payment Card Hacking Campaign
7 Ways to Keep DNS Safe
Two More Convicted in $30M Massive Hacking, Securities Fraud Operation

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Major International Airport System Access Sold for $10 on Dark Web