Hello, welcome to the Tuesday, September 29th, 2020 edition of the Sandcentred Storm Center's Stormcast. My name is Johannes Ulrich. And today I'm recording from Jacksonville, Florida.

As mentioned before, I usually don't cover breaches unless there is sort of a lesson to be learned or something to be taken away from the particular breach.

Now, Tyler Technologies has had a ransomware attack, and as part of this attack,

apparently data was not just encrypted, but as it is typical, these days, it was also exfiltrated.

We have now a number of different reports that credentials that Tyler used to connect

to customers, networks are being used by bad guys.

So Tyler Technologies is a technology provider as such they remote administer customers'

systems and well that's where these credentials come in play. Now Tyler itself has notified

customers that credentials that Tyler typically used to connect to customers networks for remote access

were used by suspicious logins. We also had a reader tell us that they found a Baumgar client

on a system that was managed by Tyler. Now, Baumgar, now actually known as Beyond Trust, they bought a Baumgart.

It's a pretty decent, legitimate tool to remote access systems.

So not clear if this was legitimately installed by Tyler for remote access or something an attacker did after

getting a hold of credentials used by Tyler.

But the takeaway here is certainly if you are a Tyler customer, you need to change any credentials

that you gave to Tyler, call them up, coordinate with them to

do so, and of course carefully monitor any systems that they had access to. And that's kind of a

little bit true for any kind of remote access that you grant to other companies.

Of course, often you do grant that remote access so they can monitor the systems for you.

It's a little bit of catch-22 in giving them the credentials. Well, you also need to make sure that they are treating those credentials with the necessary care.

And then we have an interesting diary by Xavier who looked into a power shell backdoor

that's sort of launched from shell code that's actually injected into an initial

...