The Las Vegas Sands cyberattack: a forgotten test server and a wiped casino network

One of the world's largest casino companies had about three-quarters of its Las Vegas servers wiped in early 2014, and the attackers got their start on a test web server at a casino in Pennsylvania.^[1][2] This case file covers the remark that preceded the attack, how the intruders moved from a side door to headquarters, what the damage cost, and the one control that was missing.

What happened

How they got in

The weak point was not the casino floor or the main website. It was a server built for testing, the kind of machine that is often set up quickly, given a simple login, and then forgotten while attention goes to production systems. The attackers ran automated password guessing against it, trying thousands of combinations a minute until one worked.^[1]

Once on that machine, they looked for passwords left behind by people who had logged in earlier. One belonged to an engineer with access to the Las Vegas headquarters network, and the company's internal connection between sites let them follow that path.^[1][4] In other words, a low-value test box in one property shared enough with the rest of the business that taking it over opened the way to everything else.

The wiper itself was not sophisticated. Reports described it as a short program of about 150 lines.^[1] It did not need to be clever, because by then the attackers had the access they needed.

What it cost

The company estimated the cost of replacing and rebuilding systems at more than $40 million.^[1][2] Core casino operations kept running because they relied on a separate mainframe system that the wiper did not reach.^[1] In filings, the company also said attackers had likely compromised the Pennsylvania property and may have taken data, including some customer information.^[5]

No one was charged. On February 26, 2015, Director of National Intelligence James Clapper told the Senate Armed Services Committee that Iran was responsible, and he grouped the attack with North Korea's destructive hack of Sony Pictures.^[5][6] That was the first time the U.S. government publicly attributed the Sands attack to Iran.^[6]

The missing control

The missing control: lock down forgotten development servers. Test machines that face the internet need the same strong logins, limits on repeated guessing and monitoring as production systems, or they should not face the internet at all.

Each part of that would have helped. Blocking an account after a handful of wrong guesses, or requiring a second login factor, would have made the password-guessing attack fail. Keeping the test server off the internet, or behind a login only staff could reach, would have taken away the side door entirely. And keeping development machines separated from the network that connects to headquarters would have meant that even a fully compromised test box led nowhere. Thousands of guesses a minute is also noisy; someone watching that server's logs had a chance to spot it weeks before the wipe.^[1]

What to do in your business

• Find your test and staging sites. Ask your web developer or IT provider to list every copy of your website, test server and old admin page that can be reached from the internet, and shut down anything nobody needs.
• Put real logins on what remains. Every admin page and remote login should use a long unique password, a second factor and a lockout after repeated failures.
• Keep test systems apart. Development machines should not share passwords or network access with the systems that run payroll, email or customer records.
• Turn on alerts for failed logins. Most hosting and remote-access tools can email you when there are many failed attempts. Switch that on.
• Keep offline backups. A wiper destroys what it can reach, so keep at least one recent backup disconnected from the network and test restoring from it.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.