• Latest
  • Trending

Microsoft: Multiple Exchange Server Zero-Days Under Attack by Chinese Hacking Group

March 9, 2021
iOS 15.5 arrives ahead of Apple’s annual developer conference

iOS 15.5 arrives ahead of Apple’s annual developer conference

May 17, 2022
Researchers devise iPhone malware that runs even when device is turned off

Researchers devise iPhone malware that runs even when device is turned off

May 17, 2022
AMD Ryzen 7000 “Phoenix” APUs with RDNA3 Graphics to 3D V-Cache

AMD Ryzen 7000 “Phoenix” APUs with RDNA3 Graphics to 3D V-Cache

May 17, 2022
Huawei holds maiden ICT to develop 100,000 ICT Talents through LEAP in Ghana

Huawei holds maiden ICT to develop 100,000 ICT Talents through LEAP in Ghana

May 17, 2022
Nokia Moves HR Functions to Oracle Fusion Cloud HCM

Nokia Moves HR Functions to Oracle Fusion Cloud HCM

May 17, 2022
Ericsson and Turkcell Perform Turkey’s First 5G Connected Mobile Robot Demo

Ericsson and Turkcell Perform Turkey’s First 5G Connected Mobile Robot Demo

May 17, 2022
Relativity and ENSafrica to Help Expand the African Cloud Capabilities

Relativity and ENSafrica to Help Expand the African Cloud Capabilities

May 17, 2022
MTN Nigeria Adopts LigaData’s Time Machine

MTN Nigeria Adopts LigaData’s Time Machine

May 17, 2022
NVIDIA Certifies NetApp EF600 For DGX SuperPOD

NVIDIA Certifies NetApp EF600 For DGX SuperPOD

May 17, 2022
PNY Announced XLR8 DDR5-6000 MAKO RGB Memory Kits

PNY Announced XLR8 DDR5-6000 MAKO RGB Memory Kits

May 17, 2022
V-Color Manta XPrism RGB SCC DDR5-6200 CL36 2x 16 GB

V-Color Manta XPrism RGB SCC DDR5-6200 CL36 2x 16 GB

May 17, 2022
WD Announces WD Black SN850X and P40 Game Drive

WD Announces WD Black SN850X and P40 Game Drive

May 17, 2022
  • Consumer Watch
  • Kids Page
  • Directory
  • Events
  • Reviews
Tuesday, 17 May, 2022
  • Login
itechnewsonline.com
  • Home
  • Tech
  • Africa Tech
  • InfoSEC
  • Data Science
  • Data Storage
  • Business
  • Opinion
Subscription
Advertise
No Result
View All Result
itechnewsonline.com
No Result
View All Result

Microsoft: Multiple Exchange Server Zero-Days Under Attack by Chinese Hacking Group

by itech-Manager
March 9, 2021
in Infosec, Leading Stories
0 0
0

Microsoft late Tuesday raised the alarm after discovering Chinese cyber-espionage operators chaining multiple zero-day exploits to siphon e-mail data from corporate Microsoft Exchange servers.

Redmond’s warning includes the release of emergency out-of-band patches for four distinct zero-day vulnerabilities that formed part of the threat actor’s arsenal.

YOU MAY ALSO LIKE

iOS 15.5 arrives ahead of Apple’s annual developer conference

Researchers devise iPhone malware that runs even when device is turned off

Microsoft pinned the blame on a sophisticated Chinese APT operator called HAFNIUM that operates from leased VPS (virtual private servers) in the United States.

HAFNIUM primarily targets entities in the U.S. across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.

The company said its analysts assess with high confidence that HAFNIUM is state-sponsored and operating out of China, based on observed victimology, tactics and procedures.

In all, Microsoft said the attacker chained four zero-days into a malware cocktail targeting its Exchange Server (Outlook Web App) product. The vulnerabilities exposed Microsoft’s customers to remote code excecution attacks, without requiring authentication.

“In the attacks observed, the threat actor used these vulnerabilities to access on-premises Exchange servers which enabled access to email accounts, and allowed installation of additional malware to facilitate long-term access to victim environments,” Microsoft said.

“We strongly urge customers to update on-premises systems immediately,” the company urged.

Here are the raw details on the vulnerabilities being exploited in the wild.

* CVE-2021-26855 is a server-side request forgery (SSRF) vulnerability in Exchange which allowed the attacker to send arbitrary HTTP requests and authenticate as the Exchange server.

* CVE-2021-26857 is an insecure deserialization vulnerability in the Unified Messaging service. Insecure deserialization is where untrusted user-controllable data is deserialized by a program. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit.

* CVE-2021-26858 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.

* CVE-2021-27065 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.

Enterprise defenders can find additional techincal details in this blog post from the Microsoft Server team.

Microsoft said the attacks included three steps. First, the group gained access to an Exchange Server either with stolen passwords or by using the previously undiscovered vulnerabilities to disguise as someone who should have access. Second, the attackers created a web shell to control the compromised server remotely. That remote access was then used – run from the U.S.-based private servers – to steal data from an organization’s network.

In campaigns unrelated to this new batch of zero-day vulnerabilities, Microsoft said it found HAFNIUM interacting with victim Office 365 tenants. “While they are often unsuccessful in compromising customer accounts, this reconnaissance activity helps the adversary identify more details about their targets’ environments,” the company explained.  

The attackers were also able to download the Exchange offline address book from compromised systems, which contains information about an organization and its users, Microsoft added.

Cybersecurity firm Volexity, which was credited by Microsoft for reporting different parts of the attack chain, has published a blog post with technical details and a video demonstrating exploitation in action, along with known attacker IP addresses connected to the attacks. Volexity said it detected anomalous activity from two of its customers’ Microsoft Exchange servers in January 2021, which led to discovery of the attacks.

The U.S. Cybersecurity and Infrastructure Security (CISA) also issued an alert with additional information and mitigation guidance. 

Credit: By Ryan Naraine, Security Week

ShareTweetShare

Get real time update about this post categories directly on your device, subscribe now.

Unsubscribe

Search

No Result
View All Result

Recent News

iOS 15.5 arrives ahead of Apple’s annual developer conference

iOS 15.5 arrives ahead of Apple’s annual developer conference

May 17, 2022
Researchers devise iPhone malware that runs even when device is turned off

Researchers devise iPhone malware that runs even when device is turned off

May 17, 2022
AMD Ryzen 7000 “Phoenix” APUs with RDNA3 Graphics to 3D V-Cache

AMD Ryzen 7000 “Phoenix” APUs with RDNA3 Graphics to 3D V-Cache

May 17, 2022

About What We Do

itechnewsonline.com

We bring you the best Premium Tech News.

Recent News With Image

iOS 15.5 arrives ahead of Apple’s annual developer conference

iOS 15.5 arrives ahead of Apple’s annual developer conference

May 17, 2022
Researchers devise iPhone malware that runs even when device is turned off

Researchers devise iPhone malware that runs even when device is turned off

May 17, 2022

Recent News

  • iOS 15.5 arrives ahead of Apple’s annual developer conference May 17, 2022
  • Researchers devise iPhone malware that runs even when device is turned off May 17, 2022
  • AMD Ryzen 7000 “Phoenix” APUs with RDNA3 Graphics to 3D V-Cache May 17, 2022
  • Huawei holds maiden ICT to develop 100,000 ICT Talents through LEAP in Ghana May 17, 2022
  • Home
  • InfoSec
  • Opinion
  • Africa Tech
  • Data Storage

© 2021 iTechNewsOnline.Com - Powered by BackUpDataSystems

No Result
View All Result
  • Home
  • Tech
  • Africa Tech
  • InfoSEC
  • Data Science
  • Data Storage
  • Business
  • Opinion

© 2021 iTechNewsOnline.Com - Powered by BackUpDataSystems

Welcome Back!

Login to your account below

Forgotten Password?

Retrieve your password

Please enter your username or email address to reset your password.

Log In

Add New Playlist

Are you sure want to unlock this post?
Unlock left : 0
Are you sure want to cancel subscription?
Go to mobile version