FBI Actively Mitigating Compromised Corporate Exchange Servers; Critical Patches to Windows, Exchange and SAP

There are a couple of important dimensions to this one: First, the fire department going into a burning building without permission to put out a fire that may spread to adjacent buildings is a good thing overall, but may end up in extensive water damage to the burning building. The same is true for what the FBI is doing - from a business perspective, much better to *not* be a candidate for unplanned outside fixes of your compromised systems. Second: be prepared for phishing campaigns that appear to be coming from @FBI.gov – warn your supply chain as well. If you have been unable to move to restrictive DMARC anti-spoofing policies, this would be a good item to use to get high level support to do so.

John Pescatore

This both cool and unsettling. It is better to secure your own systems or hire help than to have assistance granted by court order. The FBI will be sending email to notify system owners of actions taken. Even so, be on the lookout for fake FBI.gov phishing emails. Remember these actions didn’t apply patches or forensically analyze your systems to determine what else may be impacted.

Lee Neely

While these vulnerabilities don’t appear to be actively being exploited, CISA considers them severe enough to warrant not only requiring immediate patching, but disconnecting any systems not patched by noon today. They make the point that once a fix is publicly released, the weakness can be reverse engineered to create an exploit; coupled with the current activities around exploiting Exchange servers, it’s a good idea to apply these patches now, regardless of whether you're in the public or the private sector.

Lee Neely

I hope you kept good notes, because there are four more Exchange vulnerabilities to patch. These vulnerabilities were found and reported by the NSA, and no exploit or details have been made public yet. But Microsoft considers exploitation likely.

Johannes Ullrich

Vulnerabilities in ERP systems usually do not get a lot of press. But they are heavily targeted and prior vulnerabilities in SAP (or similar products) were used to compromise numerous organizations. It often takes only days for exploits to be developed. I know this one is more difficult to patch, but make sure you get it done soon.

Johannes Ullrich

SAP is already on the radar of exploitable platforms, and the patch list includes fixes to vulnerabilities with critical (aka hot news) and high ratings. These fixes address missing authorization checks, information disclosure, and other flaws which warrant prompt action.

Lee Neely

The SolarWinds compromise pointed out that high market share apps that are put in highly sensitive places are high value targets for sophisticated attackers, and should be prioritized for patching. The SolarWinds compromise also pointed out that monitoring of high-risk systems should be stepped up after patching to reduce time to detect if an update has been compromised.

John Pescatore

If affected products are installed but not currently licensed, or not logged into the respective Creative Cloud account, the automatic update will not happen. Suggest uninstalling products with expired or no licenses to remove potentially exploitable applications from systems.

Lee Neely

Google must strike a difficult balance between identifying vulnerabilities and inviting their exploitation, a responsibility few would take on.

William Hugh Murray

Of the 37 security fixes, 19 were credited to external researchers – the value of well-managed external bug bounty programs continues to be validated.

John Pescatore

Other browsers will likely follow. More than 90% of websites are supporting HTTPS now, so this move makes a lot of sense. But you may experience some slower connections to the sites that do not support HTTPS, which will likely include internal IoT style devices.

Johannes Ullrich

This update also applies to Chromium based browsers (Edge, Brave, Vivaldi, etc.) With the migration to HTTPS over the last few years, the impact on end users is nominal. Sites on the HSTS preload list already defaulted to HTTPS. HTTP fallback is still enabled. This release also includes the first version of Google’s Federated Learning of Cohorts (FLoC) which is their answer to privacy while still delivering targeted ads. Note that FLoC is disabled by default in Brave and Vivaldi.

Lee Neely

Control systems have to not only watch for compromised products like Orion, but also for attempts to access control systems via spearphishing and VPN compromise. The GAO report from March 21 (https://www.gao.gov/products/gao-21-81) had one recommendation for DOE: to more fully address risks to the nations power grid in coordination with DHS, states and industry. Until that effort solidifies, look to a hybrid approach to protection systems rooted in the Purdue Model. Secure the perimeter, require multi-factor authentication for access, verify security settings and updates are applied, and use segmentation to allow only authorized systems to interact with control system components.

Lee Neely

There are software products and firmware in use across power systems that have the same or higher market share as SolarWinds had in that vertical, particularly on the OT networks. Identifying those and increasing prioritization of protection/segmentation/detection of those high value targets is a lesson learned from the SolarWinds compromise impact.

John Pescatore

While these numbers are not surprising, they document the severity of the attack and the resulting risk to our infrastructure.

William Hugh Murray

This report is only 27 pages and is far more than just cyber, covering military, WMD, Space, Intelligence and Influence capabilities for many countries. Use the information to better understand the threats, their motivations, capabilities, and goals and how that overlays with current world conditions.

Lee Neely

The list of vulnerabilities isn't surprising. It is not a list of difficult to exploit obscure problems, but the same list of vulnerabilities everybody else is exploiting. Use this as a good reason to double check if you are running any of the vulnerable systems, and make sure they are patched. Given that some of these vulnerabilities go back to 2018: If you still find a vulnerable system, consider it compromised.

Johannes Ullrich

Actors are taking advantage of both unpatched or improperly secured systems and reusable credentials. Beyond implementing multi-factor authentication, integrate your reusable password system (typically Active Directory) with a system which monitors for breached passwords, and require users to not select a known compromised password; immediately change passwords when they are discovered in the breach data. Prioritize the patching and security validation of any and all internet facing services. Dispel beliefs that your access server is obscure and not discoverable by looking for similar products in a tool like Shodan.

Lee Neely

After SolarWinds, we should hardly need such a warning. It is urgent that we restore trust in our infrastructure. In the meantime, we can resist some further damage by implementing strong authentication (at least two kinds of evidence, at least one of which is resistant to replay), one of our most efficient protective measures.

William Hugh Murray