WyzGuys Tech Talk

A quick Saturday digest of cybersecurity news articles from other sources.

Exchange Server Vulnerability Exploits Are ‘Widespread and Indiscriminate’

We’ve been tracking US-CERT and CISA alerts for years, and this is some of the most urgent language we’ve seen used. The Cybersecurity and Infrastructure Security Agency issued a special bulletin on February 8, titled, CISA Strongly Urges All Organizations to Immediately Address Microsoft Exchange Vulnerabilities. It warned: “As exploitation of these vulnerabilities is widespread and indiscriminate, CISA strongly advises organizations follow the guidance laid out… which provides specific steps for both leaders and IT security staff and is applicable for all sizes of organizations across all sectors.” In other words, attacks using these vulnerabilities might be as ubiquitous as Microsoft Exchange itself. CISA is now issuing advice on remediating these critical Zero-Day… Read more

The Chinese Have Likely Hacked Your Exchange Email Server

What if Chinese state-sponsored hackers have owned your OWA using several brand-new zero-day vulnerabilities? Or worse, Eastern European Ransomware Criminals?

On March 2, Microsoft released emergency security updates to plug four security holes in Exchange Server versions 2013 through 2019 that hackers were actively using to siphon email communications from Internet-facing systems running Exchange.

The Chinese hacking group thought to be responsible has seized control over “hundreds of thousands” of Microsoft Exchange Servers worldwide, at least 30,000 in America — with each victim system representing approximately one organization that uses Exchange to process email.

The truth is, if you are running an OWA server exposed to the internet, assume you have been compromised between 02/26-03/03 and you are now in incident response mode until proven otherwise.

An adversary owning your email systems, being able to see all threads, and injecting a reply containing a malicious link into an existing thread between trusted parties is a worrying thought. You got to train your users for events like this! And of course patch those systems immediately.

It was all over the press, but Brian Krebs covers it the best as usual, and he has a quick thing you can check to see if you are compromised:
https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/

Here is the Microsoft blog about this urgent issue, where they have an update that multiple bad actors are attacking unpatched systems.
https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

Microsoft IOC Detection Tool for Exchange Server Vulnerabilities

Original release date: March 6, 2021

Microsoft has released an updated script that scans Exchange log files for indicators of compromise (IOCs) associated with the vulnerabilities disclosed on March 2, 2021.

CISA is aware of widespread domestic and international exploitation of these vulnerabilities and strongly recommends organizations run the Test-ProxyLogon.ps1 script—as soon as possible—to help determine whether their systems are compromised. For additional information on the script, see Microsoft’s blog HAFNIUM targeting Exchange Servers with 0-day exploits.

Guidance on Remediating Networks Affected by the SolarWinds and Active Directory/M365 Compromise

Original release date: March 9, 2021

Since December 2020, CISA has been responding to a significant cybersecurity incident involving an advanced persistent threat (APT) actor targeting networks of multiple U.S. government agencies, critical infrastructure entities, and private sector organizations. The APT actor added malicious code to multiple versions of the SolarWinds Orion platform and leveraged it—as well as other techniques, including—for initial access to enterprise networks. After gaining persistent, invasive access to select organizations’ enterprise networks, the APT actor targeted their federated identity solutions and their Active Directory/M365 environments. CISA has published two new resources on the follow-on activity from this compromise.  More…

Serious Security: Webshells explained in the aftermath of HAFNIUM attacks

Webshells explained, with some (safe) examples you can try at home if you want to learn more.

How your remote employees may be sharing sensitive data

A majority of employees said they share sensitive information through messaging and collaboration tools, says Veritas.

150,000 security cameras allegedly breached in “too much fun” hack

Cloud security cameras rained confidential customer data, says Bloomberg.

GitHub Discovers Authentication Issue

If you find yourself logged out of GitHub, there is actually a good reason why. GitHub announced a security update due to a bug causing issues with the authentication of sessions. Mike Hanley, GitHub’s new CSO as of February 2021, shared why users may have been logged out of the platform: “On the evening of March 8, we invalidated all authenticated sessions on GitHub.com… out of an abundance of caution… Read more