Construction Sector At Risk As Hackers Exploit FOUNDATION Software

Security researchers at Huntress announced today that they discovered a hacking campaign targeting companies using FOUNDATION Accounting Software, a popular program in the construction industry.

The hackers are taking advantage of a simple weakness: many companies haven’t changed the default passwords that come with the software.

Normally, databases like the one used by FOUNDATION Accounting Software are kept private and protected by a firewall or VPN.

However, FOUNDATION’s mobile app feature allows for public access to the database through a specific TCP port. This makes the database more vulnerable to attacks.

Once inside, the attackers can take control of the system and run harmful commands that allow them to steal information or cause damage.

Huntress observed that the attack was automated, hitting multiple companies in just a few minutes. In one case, attackers made over 35,000 attempts before finally getting access.

To protect against this threat, Huntress recommends that all companies using FOUNDATION immediately change the default passwords, avoid exposing the software to the public internet, and disable certain risky features that hackers can exploit.

The researchers reported that they initially identified the malicious activity targeting Foundation last week.

Huntress has already taken action by isolating affected machines and notifying customers who may be at risk. Although the vulnerability is a serious concern, taking these security measures can prevent further attacks.

FOUNDATION did not respond to Recorded Future News‘ (RFN) request for comment by the time of publication on Tuesday.

While the extent of the damage caused by these attacks remains unclear, as noted by the RFN, it is crucial for affected companies to investigate and take appropriate steps to mitigate any potential harm.