Attacks Leveraging Microsoft Exchange Vulnerabilities 'Have Escalated', Doubling Every Three Hours (cnn.com) 43
Attacks that leverage Microsoft Exchange vulnerabilities "have escalated," warns CNN. They cite a senior White House official saying the window for updating exposed servers is incredibly short -- "measured in hours, not days."
On Thursday, Microsoft and security researchers warned that the vulnerabilities are now being combined with another potent cybersecurity threat: ransomware, which locks up a computer or a network's files and holds them hostage until the victim pays a fee. "We have detected and are now blocking a new family of ransomware being used after an initial compromise of unpatched on-premises Exchange Servers," Microsoft said in a tweet.
Security experts at Palo Alto Networks estimated Thursday that at least 20,000 US-based Exchange servers remain unpatched and vulnerable to exploitation, and as many as 80,000 around the globe.
Other security researchers say the pace of attacks against Exchange servers is rising as opportunistic hackers seek to take advantage of the opening found by Hafnium, the group Microsoft has said is responsible for the original breaches and is "assessed to be state-sponsored and operating out of China." The number of attempted attacks against organizations has been doubling every two to three hours, according to Check Point Research, which monitors the internet for malicious activity.
Security experts at Palo Alto Networks estimated Thursday that at least 20,000 US-based Exchange servers remain unpatched and vulnerable to exploitation, and as many as 80,000 around the globe.
Other security researchers say the pace of attacks against Exchange servers is rising as opportunistic hackers seek to take advantage of the opening found by Hafnium, the group Microsoft has said is responsible for the original breaches and is "assessed to be state-sponsored and operating out of China." The number of attempted attacks against organizations has been doubling every two to three hours, according to Check Point Research, which monitors the internet for malicious activity.
Weird chain of notification (Score:4, Interesting)
Attacks that leverage Microsoft Exchange vulnerabilities "have escalated," warns CNN. They cite a senior White House official saying the window for updating exposed servers is incredibly short -- "measured in hours, not days."
Why are we hearing this from a "senior White House official" and not Microsoft?
And why is this from CNN?
Very odd.
Re:Weird chain of notification (Score:5, Informative)
Why are we hearing this from a "senior White House official" and not Microsoft?
Because Microsoft is trying to limit the damage to themselves.
And why is this from CNN?
Because CNN is a news organization. Their job is to provide information about issues which people may be interested in or affects them in some way.
Re: (Score:3)
A Conspiracy!!! Yep, definitely a conspiracy. No news organization should make any decisions on what to report, report everything all the time, everywhere! What? Not enough bandwidth you say? Aha!! Caught you, another Conspiracy to deny you the news you deem is news. Those bastards!
Re: (Score:2)
Well technically the news CNN wants you to hear about. Nothing else. Since they sensor much of what is newsworthy out there and seem to have an agenda I don't think I will be looking for reliable tech news from CNN. Much like slashdot these days.
You don't like what they choose to report, so you don't consider them reliable. Got it.
Thanks for notifying everyone of your thought.
But given that you thought your thought was the only news worthy to report today, I think I'll stick with other sources. You don't seem reliable.
Re: (Score:2)
Except that CNN has completely quit the news business, around 2015.
It used to be a biased but reliable news source (ie, they'd interpret facts their way, but at least mention the facts even if unfavorable), it is more akin to left-winged Daily Stormer than to something reputable.
CNN is an extreme case, but this insanity has infected most of US news. Compared with the US, here in Poland only govt-run media have this hide-all-unfavourable-facts, lie-completely-otherwise shtick, while independent media, while
Re: (Score:2)
Same in Canada where the State Broadcasting and News system suffers the same problem. Unfortunately in Canada almost all the "broadcasters" and "publishers" (meaning Television, Radio, and Print) are "financed" by the Government -- ownership is therefore not required -- they all know on which side Justin "sex offender" Trudeau butters their bread and they all tow the party line and publish only approved opinions almost totally devoid of "fact".
The only exceptions are those (very few) outlets which do not a
Born to be pwned? (Score:2)
Just had to get that joke off my chest, but I guess it's also a minor criticism of the FP question. Yes, it is a legitimate question, but I'm doubting it's the best way to have started the discussion.
My primary question is "Is there a threat to users of email who are limited to outlook.com email?" I'm almost certain that Microsoft eats their own dog food and uses Exchange servers in house, but I can think of various reasons that outlook.com might not use them.
My secondary question is "Can this vulnerability
Re: (Score:2)
Okay, back again, and able to confirm that the linked story does not mention outlook.com at all. Also, I'm the only one to mention outlook.com so far in this discussion, but I'll check back later, though mostly for the witty jokes that rarely appear these days. (But obviously need to check on some websites with more technical and security sophistication than CNN.) Still don't know what was bugging Firefox (again). Now what about that mysterious Printer driver update from Microsoft that keeps rebooting my co
Re: (Score:2)
I don't have the link handy, but when this was first reported a few days ago, it was mentioned that M$' own services (outlook.com, O365, etc.) were supposedly patched before the vuln was publicly announced.
This is hearsay, and poorly remembered hearsay at that. YMMV.
Re: (Score:2)
I suppose perhaps it's a measure of the seriousness of the attack. A very large number of businesses use Exchange, and as a consequence, a lot of people are being affected by this. Previously, there have been worms and malware that made the general news as well, ILOVEYOU, MyDoom, Zeus, Code Red... basically, anything that affected a lot of people / businesses, or had some unusual aspect, like StuxNet.
I think the White House and CNN are involved because there's a need to get the word out to as many people
Notification from the U.S. government: (Score:2)
Remediating Microsoft Exchange Vulnerabilities [cisa.gov].
It seems to me that Microsoft is not managed well. There are MANY articles about that:
Windows 10 is possibly the worst spyware ever made. [networkworld.com]
Quoting: "Buried in the service agreement is permission to poke through everything on your PC."
Windows 10 problems are ruining Microsoft's reputation -- and the damage can't be understated. [techradar.com] (Sept. 28, 2019)
Criticism of [wikipedia.org]
Re: (Score:2)
The Microscrewups are hiding and hoping this will blow over, like so much of the damage they have done.
Re: (Score:2)
Mod parent up, though it's not the biggest insight of the day.
I actually think the EULA may be the largest innovation that can be attributed to Microsoft--but even that EULA is just a refinement of other people's ideas. The key notion is that no matter how badly Microsoft screwed up and no matter how much damage was (and is) caused by Microsoft's incompetence or negligence no one can legally touch Microsoft. (The #2 innovation was selling upstream rather than to end users.)
If Microsoft had ANY residual frac
Re: (Score:2)
Mod parent up, though it's not the biggest insight of the day.
Indeed it is not. It is so blatantly obvious that using MS crap on servers is a bad idea, it should automatically count as gross negligence.
Re: (Score:2)
Indeed it is not. It is so blatantly obvious that using MS crap on servers is a bad idea, it should automatically count as gross negligence.
What a wonderful world that would be...
Re:Weird chain of notification (Score:5, Funny)
Attacks that leverage Microsoft Exchange vulnerabilities "have escalated," warns CNN. They cite a senior White House official saying the window for updating exposed servers is incredibly short -- "measured in hours, not days."
Why are we hearing this from a "senior White House official" and not Microsoft?
And why is this from CNN?
Very odd.
I suppose you could wait until Fox News reports it so you know it's true.
Re: (Score:2)
I suppose you could wait until Fox News reports it so you know it's true.
Fox news won't cover it because it doesn't effect AOL mail. Citation https://www.volomp.com/isp/bye-bye-aol-yahoo-hello-oath/ [volomp.com]
Cymbal crash! Well played, Sir or Madam!
Re: (Score:2)
There are a few reasons.
1. Signs point to this attack being launched and leveraged by nation state actor. I.e. It's State sponsored cyberwarfare. That's why the White House is involved.
2. It's weird for the White House to speak about a cybersecurity issue. CNN is reporting on it because it's weird and widespread. I recall similar reporting for e.g. Code Red, Nimda, and Slammer*.
* I just realized that was 18 years ago. Holy crap I'm old.
Back to the topic at hand, Microsoft's official guidance is to pat
Re: Monoculture (Score:1)
No, it is like having the same prefab house as everyone in town.
The one from that construction company that is known in the city for their for insecure houses, and is led by that heavily tattoed "ex"-almost-con who "changed. really!", after he somehow managed to never get real prison time for decades, despite literally trying to rape Ms Linux by wearing the skin of her uncle SCO, and having Ms Nokia die from a pregnancy with his rape child, but /did/ convince the judge once, that letting him give a copy of
Forgot the best part: (Score:1)
.. that letting him give a copy of his prefab school building to a bunch of schools, instead of going to prison, is somehow "punishment" enough, despite his connections making those copies for free, ...
Re: (Score:1)
Re: Has the WHO declared it a pandemic yet? (Score:1)
Better call Dr. Fauci, now Biden will have to wear 3 masks to compromise his N95
Re: Has the WHO declared it a pandemic yet? (Score:2)
With enough "doubling every 3 hours" (Score:2)
In a couple days, every Exchange server in the world will be hosed.
So, good news.
Re: (Score:2)
In a couple days, every Exchange server in the world will be hosed.
So, good news.
Indeed. Maybe a few more people will wake up to what MS really is.
Re: (Score:3)
I'd give you the Funny mod if I could.
And I am SOOO glad not to be using any Notes email these days and I would file it under "good news" if I heard that the last Notes email servers had been extinguished.
But I still want to know if this affects me. The only link I might have is via outlook.com, though I barely use it. Basically pushed that way by Microsoft for their own convenience, though I responded by renaming that user "Awk Q Punt" some years ago. But Mr Punt may not be so easily amused if that account
Re: (Score:2)
I'd give you the Funny mod if I could.
And I am SOOO glad not to be using any Notes email these days and I would file it under "good news" if I heard that the last Notes email servers had been extinguished.
But I still want to know if this affects me. The only link I might have is via outlook.com, though I barely use it. Basically pushed that way by Microsoft for their own convenience, though I responded by renaming that user "Awk Q Punt" some years ago. But Mr Punt may not be so easily amused if that account is actually running on an Exchange server at the other end...
I remember a time when I had multiple Notes accounts, Multiple self hosted Exchange accounts and multiple unix mail accounts. It wasn't good.
I think this applies more to people hosting their own Exchange servers (with little or no IT support, or knowedge) and outlook.com may be getting hammered by attempts, but I would hope they have some good security, because if outlook.com becomes compromised, it would be very, very bad for Microsoft.
Re: (Score:2)
My condolences for your bad memories and I hope you're right about outlook.com.
Re: (Score:2)
My understanding is that users of Microsoft's cloud services O365 and Outlook.com, are not effected.
It's a vulnerability in Exchange.
Re: (Score:2)
My concern was with indirect effects, but that would depend on such questions as (1) Is outlook.com using Exchange servers on the other end? and (2) Is Microsoft able to protect its own Exchange servers? However, I can think of several ways that we could be affected, for example by having our personal information breached on the server side or by receiving phishing spam from unprotected servers.
Funny coincidence time: Just reading a not-so-old book about computer security that praises Microsoft's security e
Ad for SaaS? (Score:2)
... compromise of unpatched on-premises Exchange Servers ...
Is this circus just an ad to scare companies into Exchange/Office SaaS?
Re: (Score:2)
While plausible, MS is fundamentally incompetent. They could not pull off something like this.
Re: (Score:2)
None of those are remote exploits, dumbass
Ransom ware is good (Score:1)
Makes companies aware they have had hackers In their environment.
Might actually be the lesser evil compared to a long time exploit.
Re: (Score:2)
Makes companies aware they have had hackers In their environment. Might actually be the lesser evil compared to a long time exploit.
This might possibly be the stupidest comment I've ever read on Slashdot.
Use crapware... (Score:2)
... get hacked. What else is new. Only the terminally stupid put Microsoft on anything even remotely resembling a server.
Lotus Notes (Score:2)
What we alway knew (Score:2)
Everyone with even half a brain always knew that Microsoft Exchange Server was manifestly unfit for connection to the Internet. In fact, everything created by Microsoft is manifestly unfit for connection to the Internet. Microsoft products require one to take extreme measures to provide security external to the products themselves, and this has always been the case.
It would appear that there are a lot of maroons who have forgotten that simple premise.