Cyberattack on Berlin city administration: what can we learn from this?
Unfortunately, it was quite easy:
An employee with the Berlin City Senate Transport Administration clicked on a link in a phishing email (these things happen) and was redirected to a fake website featuring a so-called ‘CAPTCHA’.
CAPTCHAs are used to check whether a human is sitting in front of the computer.
You’re probably familiar with this: sixteen little pictures, and you’re asked to select all the ones showing e.g. a traffic light.
Instead of these little images, the user was asked to press a series of keyboard shortcuts one after the other.
First the Windows key + X, then I, then Ctrl + V, and so on. It looked something like this:
The user followed the instructions – but unfortunately, they had administrator rights on their computer.
By following the steps described, the user unknowingly pasted the contents of their compromised clipboard into a Windows command line, thereby executing a malicious command. This is how the attackers gained access.
According to the German Office for Information Security, this attack method, known as ‘TerminalFix’, is a further development of the method known as ‘ClickFix’.
What followed in Berlin illustrates what is at stake: over a million files as well as passwords have since appeared on the dark web.
What does this mean for businesses?
- Admin rights must only be held by genuine administrators – that is, people with the relevant knowledge and experience.
- Staff awareness is a central component of any security strategy. It is essential.
- Multi-factor authentication and restrictive access rights make it more difficult for attackers to spread across the network once they have gained initial access.
Summary:
When inexperienced users and weak security measures come together, the question isn’t “if” something will happen, but simply “when.” Be wary of links in emails. Question what you see. And when in doubt, there is no harm in a second or third opinion.