homepage
Open menu

SANS NewsBites

HAFNIUM Actively Exploiting Exchange Server Vulnerabilities: Microsoft Issues Patches and CISA Issues Executive Order to Mitigate Flaws; More SolarWinds Malware Discovered

March 5, 2021  |  Volume XXIII - Issue #18

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2021-03-03

Microsoft Fixes Exchange Server Flaws Exploited by Hafnium Threat Actor

Microsoft has warned that Hafnium, a state-sponsored threat actor operating from China, has been exploiting four previously unknown vulnerabilities in Microsoft Exchange Server software to gain access to networks of targeted organizations and exfiltrate data. The attacks target on-premises Exchange Server software. Microsoft has released updates to address the vulnerabilities. They affect Microsoft Exchange Server 2013, 2016, and 2019.

Editor's Note

Note this only applies to on-premise Exchange servers, Microsoft 365, aka Exchange Online, is not impacted. The vulnerabilities being exploited are CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. While not vulnerable, the update includes patches for Microsoft Exchange Server 2010 for defense in depth; in other words patch all versions of Exchange from 2010 forward. While a migration to MS 365 may on your strategic roadmap, that migration takes significant time, planning and orchestration, and can be disruptive. Accelerating that plan, or initiating one from scratch, is not an effective alternative to patching these vulnerabilities. Patch first then resume your migration as planned.

Lee Neely
Lee Neely

2021-03-03

CISA Orders Federal Agencies to Mitigate Exchange Server Vulnerabilities

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an Emergency Directive that requires federal government agencies to mitigate ”all instances of on-premises Microsoft Exchange Servers in the environment.” CISA recommends that organizations examine systems for evidence of malicious activity. If none is found, agencies should apply the security updates. If evidence of malicious activity is found, agencies “should assume network identity compromise and follow incident response procedures.” Agencies have until noon EST on Friday, March 5 to submit a report to CISA regarding actions taken.

Editor's Note

Because this is being actively exploited, Federal agencies are expected (per ED 21-02 below) to forensically image systems and check for indicators of compromise or anomalous behavior, disconnecting exchange servers if indications of compromise are found until further notice. This applies to all Exchange systems, unclassified and classified. Systems without indicators of compromise are expected to be patched immediately. If you don’t have the capability to perform the requested actions, CISA will provide technical assistance.

Lee Neely
Lee Neely

2021-03-03

Exchange Server Attacks

The Hafnium threat actors have been exploiting four critical vulnerabilities in Microsoft Exchange Server to gain access to email and steal and exfiltrate data. The attackers have targeted defense contractors, law firms, policy think tanks, non-government organizations, and organizations conducting infections disease research.

Editor's Note

Microsoft’s mitigation guidance says “The initial attack requires the ability to make an untrusted connection to Exchange server port 443. This can be protected against by restricting untrusted connections, or by setting up a VPN to separate the Exchange server from external access.”  Well architected, segmented and maintained DMZs and remote access capabilities should be doing this in addition to being patched quickly. All too often, however, they are not. I assume this is one reason why Microsoft says, “Exchange Online is not affected.” The other is issue is how slowly enterprises deploy patches vs. how quickly the patches are applied to the cloud services they consume.

John Pescatore
John Pescatore

Assume that attackers are actively scanning the Internet looking for exposed Exchange services such as OWA to exploit. Patch Internet accessible Exchange services first, and even if your other Exchange services are not exposed to the internet, make sure to update them as well. Use the latest version of the Microsoft Exchange Server Health Check script to see if your Exchange server updates are current. https://aka.ms/ExchangeHealthChecker

Lee Neely
Lee Neely

2021-03-04

Microsoft and FireEye Provide Details About New SolarWinds Malware

In a blog post, Microsoft describes newly detected malware that has ties to the SolarWinds supply chain attack. GoldMax is a command-and-control backdoor; Sibot helps achieve persistence on targeted machines and downloads and executes payloads; GoldFinder is an HTTP tracer tool. The new strains were used in the later stages of the attack in August and September 2020. FireEye has also provided details about the command-and-control backdoor, which it calls SUNSHUTTLE.

The Rest of the Week's News

2021-03-04

Accellion FTA Vulnerability: Qualys Server Breached, Files Stolen

Qualys has confirmed that it is among the organizations affected by the Accellion File Transfer Appliance (FTA) vulnerability. Cyber extortionists published files that appear to have come from a Qualys server. Qualys says it had “deployed the Accellion FTA server in a segregated DMZ environment, completely separate from systems that host and support Qualys products.”

Editor's Note

Qualys not only applied the updates to the FTA server, but also enabled additional monitoring and alerting. Even so, they fell victim to a zero-day. The FTA appliances are unsupported, and even so, Accellion is working to resolve deficiencies in the FTA appliance to aid transition to new solutions. These activities have rendered the FTA appliance a target of opportunity, meaning you need to accelerate your migration. If you decide to take your FTA appliance offline immediately, make sure to provide guidance and implement monitoring for work-arounds or other Shadow-IT solutions.

Lee Neely
Lee Neely

All enterprises using this flawed product should be looking for indicators of compromise, keeping in mind that "the absence of evidence is not evidence of absence."

William Hugh Murray
William Hugh Murray

2021-03-04

Data Breach Affects Malaysia Airlines Frequent Flyer Members

Malaysia Airlines has disclosed that data belonging to members of its frequent flyer program were compromised for nine years. The breach occurred on the system of a third-party IT provider. The breach affects members of the Enrich frequent flyer program who registered between March 2010 and June 2019. In a separate story, data belonging to 580,000 Singapore Airlines frequent flyer members was compromised.

2021-03-05

Code Dependency Confusion Attack Targeting Amazon, Lyft, Slack, and Others

Attackers have weaponized a proof-of-concept code dependency confusion exploit to target internal applications for Amazon, Lyft, Slack, Zillow, and other companies by injecting malicious code into developer projects in the npm public code repository.

2021-03-04

CompuCom MSP Discloses Ransomware Attack

IT managed services provider (MSP) CompuCom has disclosed that its IT systems were a ransomware attack, which has affected services provided to some customers. Last weekend, customers attempting to open troubleshooting tickets in the customer portal saw error messages.

2021-03-03

MITRE Ransomware Resource for Healthcare Organizations

On Monday, March 1, MITRE launched a Ransomware Resource Center for healthcare organizations. The website offers advice tailored to specific IT-related roles in healthcare. Tools are categorized according to the National Institute of Standards and Technology (NIST) Cybersecurity Framework: Identify, Protect, Detect, Respond, and Recover.

Editor's Note

Healthcare organizations have been a big fat target this last year and this resource is a boon to those working to improve their security. The organization of advice by IT roles as well as groupings by the five stages in the NIST framework make it really easy to find relevant guidance. Resources include not only direct links to reference standards but also explanations and supporting references to aid understanding. Even if you think you’re good to go, peruse the references on the MITRE site below for ideas to shore up your existing plans.

Lee Neely
Lee Neely

While tools specialized to the purpose and environment are welcome, it is the lack of timely application of tools, not a shortage of them that is the issue.

William Hugh Murray
William Hugh Murray

2021-03-04

CISA and NSA Release Guidance on Choosing Protective DNS Service

The US Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) have issued a joint information sheet providing guidance for selecting a protective DNS (PDNS) service. The document describes how PDNS works and provides an analysis of PDNS providers broken down by capabilities.

Editor's Note

The PDNS selection guide provides a comparison of PDNS providers to aid selection. PDNS provides a layer of protection beyond DNSSEC and DOH to classify upstream responses as Phishing, Malware, Algorithmically Generated as well as other categories to aid content filtering (e.g., porn, gambling). Note that PDNS will not help sites directly access via a local host table or use of the IP Address.

Lee Neely
Lee Neely

2021-03-04

GAO: DOD Needs to Provide Guidance for Cybersecurity Language in Weapons Systems Contracts

According to a report from the Government Accountability Office (GAO), three of five DOD weapons systems contracts reviewed by GAO had no cybersecurity requirements as awarded, and just vague recommendations added later. GAO recommends “that the Army, Navy, and Marine Corps provide guidance on how programs should incorporate tailored cybersecurity requirements into contracts. [Those contracts] should define requirements, identify criteria for accepting or rejecting the work, and establish how the government will verify that requirements have been met.”

Editor's Note

Include cyber security provisions in all contracts where your information will be processed or exchanged. While obvious when selecting a cloud service or IT outsource, it also must be considered for other activities such as forwarding designs for external fabrication. Be sure to include requirements flow down, protection, storage as well as contract termination/data recovery along with your right to audit/verify.

Lee Neely
Lee Neely

Internet Storm Center Tech Corner