Microsoft servers being hacked ‘faster than anyone can count’: Report
Taiwanese electronics and computer maker Acer has already been hit by a ransomware attack where the hackers are demanding $50 million, the largest known ransom to date.
Multiple state-sponsored hacking groups are exploiting a recently-fixed vulnerability in Microsoft Exchange email servers. The firm had patched the flaw in February.
The exploitation attempts were first spotted by a London-based cyber security firm, Volexity, that saw this vulnerability -CVE-2020-0688 -exploited in the wild by advanced persistent threat (APT) actors.
Advertisement
The vulnerability was discovered by an anonymous security researcher and reported to Microsoft by way of Trend Micro’s Zero Day Initiative.
Advertisement
“Two weeks after the security updates were released, the Zero Day Initiative published a blog post providing more details on the vulnerability. The post made it clear that an attacker could exploit a vulnerable Exchange server if the three criteria are not met,” said the Volexity Threat Research team.
“The Exchange Server had not been patched since February 11, 2020; The Exchange Control Panel (ECP) interface was accessible to the attacker and the attacker has a working credential that allows them to access the Exchange Control Panel in order to collect the ViewState Key,” the security researchers noted.
Volexity has observed multiple APT actors exploiting or attempting to exploit on the servers. In some cases, the attackers appear to have been waiting for an opportunity to strike with credentials that had otherwise been of no use.
Many organisations employ two-factor authentication (2FA) to protect their VPN, e-mail, etc., limiting what an attacker can do with a compromised password.
“This vulnerability gives attackers the ability to gain access to a significant asset within an organization with a simple user credential or old service account,” said security researchers.
This issue further underscores why changing passwords periodically is a good best practice, regardless of security measures like 2FA.
Microsoft was yet to react to the report issued by the cyber-security firm.
(With input from agencies)
Advertisement
