Attackers Breach 21,000 Microsoft Exchange Servers, Install Malware Implicating Brian Krebs (krebsonsecurity.com) 47
Security researcher Brian Krebs wants you to know... "New data suggests someone has compromised more than 21,000 Microsoft Exchange Server email systems worldwide and infected them with malware that invokes both KrebsOnSecurity and Yours Truly by name. Let's just get this out of the way right now: It wasn't me."
The Shadowserver Foundation, a nonprofit that helps network owners identify and fix security threats, says it has found 21,248 different Exchange servers which appear to be compromised by a backdoor and communicating with [a domain that begins with brian . krebsonsecurity... Not a safe domain.] Shadowserver has been tracking wave after wave of attacks targeting flaws in Exchange that Microsoft addressed earlier this month in an emergency patch release. The group looks for attacks on Exchange systems using a combination of active Internet scans and "honeypots" — systems left vulnerable to attack so that defenders can study what attackers are doing to the devices and how.
David Watson, a longtime member and director of the Shadowserver Foundation Europe, says his group has been keeping a close eye on hundreds of unique variants of backdoors (a.k.a. "web shells") that various cybercrime groups worldwide have been using to commandeer any unpatched Exchange servers. These backdoors give an attacker complete, remote control over the Exchange server (including any of the server's emails)... Shadowserver's honeypots saw multiple hosts with the Babydraco backdoor doing the same thing: Running a Microsoft Powershell script that fetches the file "krebsonsecurity.exe"... Oddly, none of the several dozen antivirus tools available to scan the file at Virustotal.com currently detect it as malicious. The Krebsonsecurity file also installs a root certificate, modifies the system registry, and tells Windows Defender not to scan the file. Watson said the Krebsonsecurity file will attempt to open up an encrypted connection between the Exchange server and the above-mentioned IP address, and send a small amount of traffic to it each minute.
Shadowserver found more than 21,000 Exchange Server systems that had the Babydraco backdoor installed. But Watson said they don't know how many of those systems also ran the secondary download from the rogue Krebsonsecurity domain. "Despite the abuse, this is potentially a good opportunity to highlight how vulnerable/compromised MS Exchange servers are being exploited in the wild right now, and hopefully help get the message out to victims that they need to sign up our free daily network reports," Watson said.
David Watson, a longtime member and director of the Shadowserver Foundation Europe, says his group has been keeping a close eye on hundreds of unique variants of backdoors (a.k.a. "web shells") that various cybercrime groups worldwide have been using to commandeer any unpatched Exchange servers. These backdoors give an attacker complete, remote control over the Exchange server (including any of the server's emails)... Shadowserver's honeypots saw multiple hosts with the Babydraco backdoor doing the same thing: Running a Microsoft Powershell script that fetches the file "krebsonsecurity.exe"... Oddly, none of the several dozen antivirus tools available to scan the file at Virustotal.com currently detect it as malicious. The Krebsonsecurity file also installs a root certificate, modifies the system registry, and tells Windows Defender not to scan the file. Watson said the Krebsonsecurity file will attempt to open up an encrypted connection between the Exchange server and the above-mentioned IP address, and send a small amount of traffic to it each minute.
Shadowserver found more than 21,000 Exchange Server systems that had the Babydraco backdoor installed. But Watson said they don't know how many of those systems also ran the secondary download from the rogue Krebsonsecurity domain. "Despite the abuse, this is potentially a good opportunity to highlight how vulnerable/compromised MS Exchange servers are being exploited in the wild right now, and hopefully help get the message out to victims that they need to sign up our free daily network reports," Watson said.
Popularity contest. (Score:2)
I wonder what one has to do to be so popular criminals will virtually spray paint your name all over the crime scene?
Re:Popularity contest. (Score:5, Insightful)
Want to be hated by criminals? Be at the top of your game in stopping them.
Re: (Score:2)
He catches hackers. In the past, they've DDOSed his website [csoonline.com]. When malware comes around, he is among the first to analyze it, and when he finds it, he often does investigations to find who is responsible. He reads through popular hacker forums and finds people.
Good thing (Score:5, Funny)
Good thing that proprietary closed code base keeps software like Microsoft Exchange free from widely-exploited vulnerabilities.
Re: (Score:1)
Re: (Score:2)
Security issues are found in both closed source and open source software.
Oh yeah, I completely agree with you. But, given that whenever an open source bug is announced people use it as an opportunity to cast shade on FOSS in general, I figured turnabout was fair play.
https://duckduckgo.com/?q=%22m... [duckduckgo.com]
My personal exchange server got pwned as well (Score:5, Interesting)
Re: (Score:3, Insightful)
Ookay, you say "doing it professionally" -- so how come Exchange is involved?
Re: (Score:2)
MCSEs think they are professionals.
They will tell you about "these amazing facilities that Linux will probably get /never/...", like logging and shell scripting and a (pathetic attempt at a) package manager. :)
Re: (Score:1)
MCSEs think they are professionals.
They're getting paid for it, that makes em professionals, right?
Re: (Score:2)
No you can be complete amateur hour and still get paid for it.
Why not IMAP? (Score:2)
Re: (Score:2, Informative)
Exchange has strong integration with Microsoft based account management, and strong support of the calendar integration used by Outlook. Don't underestimate the calender: to people who believe that work gets done at meetings, it's the major use for email.
The primary IMAP open source implementation, "wu-imapd", was saddled for years with the development policies of its author, Marc Crispin. Any attempt add SSL support or even point to URL's where SSL patches were available was met with wild-eyed accusations
Re: (Score:3)
wu-imapd hasn't been the "primary IMAP open source implementation" for a long time now. Pretty much everyone I know who runs an open-source IMAP server runs one of Cyrus IMAP or Dovecot.
Re: (Score:2)
Re: (Score:2)
I have not seen wu-imapd in ages. Instead, I see Dovecot as the default imapd server in RHEL, CentOS, Ubuntu and others. Dovecot provides some useful features, such as IMAPS, and STARTTLS... and STARTTLS is something all IMAP servers should have.
Roundcube is a solid web based IMAP client.
I hate to see people winding up on Gmail or M365, but it is understandable... maintaining a mail server can be a headache, because one small thing can get one's IP range on a blacklist. You can maintain it, but between I
Re: (Score:2)
As a rhetorical question, what is so different about Exchange when compared to IMAP? Why not simply use an IMAP server and be done with it?
Ignoring the rhetorical part, Exchange is a platform, IMAP is a protocol. Exchange, the platform, speaks the IMAP protocol (as well as POP and its own proprietorial protocol.) Many other mail serving platforms serve IMAP. The Exchange proprietorial protocol allows management of contact information and calendar items as well as efficient server side search. The IMAP protocol has difficulty with these features (or at least implementations that are in regular use do.)
Re:Why not IMAP? (Score:5, Informative)
As a rhetorical question, what is so different about Exchange when compared to IMAP? Why not simply use an IMAP server and be done with it?
Things IMAP doesn't do...
1.) Calendars.
2.) Contacts.
3.) Tasks.
4.) Shared Calendars.
5.) Shared Contacts.
6.) Shared Tasks.
7.) Synchronized calendars between devices.
8.) Synchronized contacts between devices.
9.) Synchronized tasks between devices.
10.) Mailbox delegation.
11.) Resource booking.
12.) Integration with the rest of a Microsoft environment.
13.) Scalable to tens of thousands of mailboxes via clustering.
14.) All of these things get set up in Outlook (and most other mail clients) with three clicks or less.
So yes, Exchange sucks. However, the Dovecot + Postfix + CalDav + CardDav + LDAP recipe has its drawbacks, primarily in setup and usage for end users. Some projects that exist now have done a pretty solid job at integrating these things more seamlessly...but as much as Mailcow and OpenXchange have hit maturity in the past few years, two decades of inertia don't just go away because someone else has something "pretty close".
Re: (Score:3)
The calendar thing is a huge deal for some businesses. The last company I worked for used it for absolutely everything. Meetings, requesting a day off, deadlines. Everything was submitted and tracked by Outlook calendar.
I thought it was kind of clunky for all the stuff they shoehorned into it, but good luck trying to get everyone to change to a new way of doing it, even if equivalent replacements exist. This same company was using godawful DOS software from the 80s for inventory tracking and other core busi
Re: (Score:2)
And do you really trust Postfix to have fewer vulnerabilities than Exchange?
Re: (Score:3)
IMAP has no 2FA/MFA security
Nonsense, client authentication is widely supported.
Malware? You mean apart from Exchange? (Score:1)
Admins were scared everywhere that somebody would patch their Exchange server.... until they head it's not Microsoft.
"Hey, now at least there's a chance they fixed something!"
Plausible Deniability? (Score:3, Funny)
Why is this still happening in 2021 (Score:2)
Re: (Score:3)
I've always said that it's because idiots that can only point-and-click are the admins, but perhaps it's actually just shitty software.
Re: (Score:3)
Re: (Score:1)
Status: OK to ship [edge-op.org]
Click Click Click (Score:1)
...they need to sign up our free daily network reports!
Oh brother!
Great sticker.. (Score:2)
When one of us gets krebbed...All of us get krebbed. We are all NOTDAN!
Krebs (Score:5, Funny)
"Let's just get this out of the way right now: It wasn't me." ;)
This is exactly what Brian Krebs would say after compromising more than 21,000 Microsoft Exchange Server email systems worldwide
Exchange is insane (Score:4)
Perhaps twice a decade starting since before exchange even had an SMTP gateway and outlook existed for some reason or another I end up setting up a small exchange server and it literally has never worked right.. every time it always chokes on something.
Memory leaks, queues getting stuck on spam messages, database corruption, services crashing... Got to the point where I found it hard to believe anyone would use or tolerate such a product.
I assumed my experience can't possibly be representative of the wider world yet the experiences have always been something that stuck with me. Each time I think it was so long ago that things must be better this time yet it always ends up sideways.
Contrast with any other mail or Zimbra like groupware I've ever used and it is day and night. If a product like this is not even reliable then it is guaranteed to be hopelessly insecure.
Re: (Score:2, Informative)
Interesting. I've had the opposite experience.
Having used exchange for 20 years with 50+ users, it's been relatively pain free.
Re: (Score:3)
That is surprising. I have been working with Exchange since 5.0 came out. It is a house of cards and way to complicated for what it needs to be; especially for small installations. I have had many times where just applying a CU completely hoses the installation and I had to revert to a backup snapshot. Lots of times the database just won't mount on startup, so you need to run edbutil to "fix" it -- even if it was already in a clean state.
The only thing that gets exposed to the Internet on the exchange
Cranking up the volume to 10 in the office (Score:2)
Join all in and sing along with me 'It wasn't me!'.
https://www.youtube.com/watch?... [youtube.com]
This is 2021 (Score:2)
People are still running their own email servers?