Microsoft: Chinese Cyberspies Used 4 Exchange Server Flaws to Plunder Emails
Microsoft: Chinese Cyberspies Used 4 Exchange Server Flaws to Plunder Emails
Tuesday, March 2nd, 2021 at 4:19 pm
Microsoft Corp. today released software
updates to plug four security holes that attackers have been using to plunder
email communications at companies that use its Exchange Server products.
The company says all four flaws are being actively exploited as part of a
complex attack chain deployed by a previously unidentified Chinese cyber
espionage group.
The
software giant typically releases security updates on the second Tuesday of
each month, but it occasionally deviates from that schedule when addressing
active attacks that target newly identified and serious vulnerabilities in its
products.
The
patches released today fix security problems in Microsoft Exchange Server 2013, 2016 and 2019. Microsoft
said its Exchange
Online service — basically hosted email for businesses —
is not impacted by these flaws.
Microsoft
credited researchers at Reston, Va. based Volexity for
reporting the attacks. Volexity President Steven Adair told
KrebsOnSecurity it first spotted the attacks on Jan. 6, 2021.
Adair
said while the exploits used by the group may have taken great skills to
develop, they require little technical know-how to use and can give an attacker
easy access to all of an organization’s email if their vulnerable Exchange
Servers are directly exposed to the Internet.
“These
flaws are very easy to exploit,” Adair said. “You don’t need any special
knowledge with these exploits. You just show up and say ‘I would like to break
in and read all their email.’ That’s all there is to it.”
Microsoft
says the flaws are being used by a previously unknown Chinese espionage group
that’s been dubbed “Hafnium,”
which is known to launch its attacks using hosting companies based in the
United States.
“Hafnium
primarily targets entities in the United States across a number of industry
sectors, including infectious disease researchers, law firms, higher education
institutions, defense contractors, policy think tanks, and NGOs,” Microsoft
said. “HAFNIUM has previously compromised victims by exploiting vulnerabilities
in internet-facing servers. Once they’ve gained access to a victim network,
HAFNIUM typically exfiltrates data to file sharing sites like MEGA.”
According
to Microsoft, Hafnium attackers have been observed combining all four zero-day
flaws to target organizations running vulnerable Exchange Server products.
CVE-2021-26855 is
a “server-side request forgery” (SSRF) flaw, in which a server (in this case,
an on-premises Exchange Server) can be tricked into running commands that it
should never have been permitted to run, such as authenticating as the Exchange
server itself.
The
attackers used CVE-2021-26857 to
run code of their choice under the “system” account on a targeted Exchange
server. The other two zero-day flaws — CVE-2021-26858 and CVE-2021-27065 —
could allow an attacker to write a file to any part of the server.
After
exploiting these vulnerabilities to gain initial access, Hafnium operators
deployed web shells on the compromised server, Microsoft said. Web shells are
essentially software backdoors that allow attackers to steal data and perform
additional malicious actions that lead to further compromise.
Neither
Microsoft nor Volexity is aware of publicly available code that would allow
other cybercriminals to exploit these Exchange vulnerabilities. But given that
these attacks are in the wild now, it may only be a matter of days before
exploit code is publicly available online.
Microsoft
stressed that the exploits detailed today were in no way connected to the separate SolarWinds-related
attacks. “We continue to see no evidence that the actor behind
SolarWinds discovered or exploited any vulnerability in Microsoft products and
services,” the company said.
Further
reading:
Microsoft’s writeup on new
Hafnium nation state cyberattacks
Microsoft technical advisory on
the four Exchange Server flaws
Comments
Post a Comment