Iranian Hackers wiped out machines at Sands Corp Casino

In December of the same year, the hackers hit the network of the Las Vegas Sands and the offensive continued also in January, when the attackers gained access to the company’s virtual private network gateway at its slots casino in Bethlehem, Pennsylvania.

“they found it: the login credentials of a senior computer systems engineer who normally worked at company headquarters but whose password had been used in Bethlehem during a recent trip. Those credentials got the hackers into the gaming company’s servers in Las Vegas. As they rifled through the master network, the attackers readied a malware bomb.” reported the post published by Bloomberg.

In February, the hackers compromised the Microsoft IIS development and staging server behind the website of the casino and used an open tool, dubbed mimikatz, to exfiltrate users’ credentials. The hackers discovered the credentials of a senior systems engineer who had visited the Bethlehem site from Las Vegas, then the attackers used them to compromise the corporate infrastructure and wipe out data on internal machines.

The wiper malware used by the attackers was written in Visual Basic and it was able to completely erased data from the hard drives of the company.

“Typing from a Sony (SNE)VAIO computer, they compiled a small piece of code, only about 150 lines long, in the Visual Basic programming language. The program proved potent. Not only does it wipe the data stored on computers and servers, but it also automatically reboots them, a clever trick that exposes data that’s untouchable while a machine is still running. Even worse, the script writes over the erased hard drives with a random pattern of ones and zeros, making data so difficult to recover that it is more cost-effective to buy new machines and toss the hacked ones in the trash.” continues the post.

The hackers compromised the network and leaked the data online, including personal information, stolen email addresses and social security numbers of employees at Sands Bethlehem site.

The attackers also posted a message for the CEO of the Las Vegas Sands Corp:

“Encouraging the use of Weapons of Mass Destruction, UNDER ANY CONDITION, is a Crime, signed, the Anti WMD Team,” said one. “Damn A, Don’t let your tongue cut your throat,” warned another.

“I’m not going to confirm anything that was speculated or written in the Bloomberg story.” said Reese .

The experts of Dell SecureWorks that were hired by the Las Vegas Sands Corp to sanitize the company systems declined to comment the incident, anyway security experts exclude the direct involvement of the Iranian Government and attributed the attack to a group of hacktivists.

Pierluigi Paganini

(Security Affairs –  Iranian Hackers, Sands Corp Casino)