Microsoft hack blamed on Chinese state-backed hackers targets small medium businesses globally | #emailsecurity


The rapidly escalating attack drew the concern of US national security officials, in part because the hackers were able to hit so many victims so quickly.

Researchers say in the final phases of the attack, the hackers appeared to have automated the process, scooping up tens of thousands of new victims around the world in a matter of days.

“We are undertaking a whole of government response to assess and address the impact,” a White House official wrote in an email on Saturday (Sunday AEDT). “This is an active threat still developing and we urge network operators to take it very seriously.”

The Chinese hacking group, which Microsoft calls Hafnium, appears to have been breaking into private and government computer networks through the company’s popular Exchange email software for a number of months, initially targeting only a small number of victims, according to Steven Adair, head of cybersecurity company Volexity. The company helped Microsoft identify the flaws being used by the hackers for which the software giant issued a fix on Tuesday.

The result is a second cybersecurity crisis coming just months after suspected Russian hackers breached nine federal agencies and at least 100 companies through tampered updates from IT management software maker SolarWinds.

Cybersecurity experts that defend the world’s computer systems expressed a growing sense of frustration and exhaustion.

“The good guys are getting tired,” said Charles Carmakal, a senior vice president at FireEye Inc, a California-based cybersecurity company.

Asked about Microsoft’s attribution of the attack to China, a Chinese foreign ministry spokesman said on Wednesday the country “firmly opposes and combats cyberattacks and cyber theft in all forms” and suggested that blaming a particular nation was a “highly sensitive political issue”.

Both the most recent incident and the SolarWinds attack show the fragility of modern networks and the sophistication of state-sponsored hackers to identify hard-to-find vulnerabilities or even create them to conduct espionage.

They also involve complex cyberattacks, with an initial blast radius of large numbers of computers that is then narrowed as the attackers focus their efforts, which can take affected organisations weeks or months to resolve.

If you are running an Exchange server, you most likely are a victim.

Steven Adair, cybersecurity expert

In the case of the Microsoft bugs, simply applying the company-provided updates will not remove the attackers from a network. A review of affected systems is required.

The US National Security Council urged the growing list of victims to carefully comb through their computers for signs of the attackers.

Initially, the Chinese hackers appeared to be targeting high value intelligence targets in the US, Mr Adair said. About a week ago, everything changed.

Other unidentified hacking groups began hitting thousands of victims over a short period, inserting hidden software that could give them access later, he said.

“They went to town and started doing mass exploitation – indiscriminate attacks compromising exchange servers, literally around the world, with no regard to purpose or size or industry,” Mr Adair said. “They were hitting any and every server that they could.”

Mr Adair said other hacking groups may have found the same flaws and began their own attacks – or that China may have wanted to capture as many victims as possible, then sort out which had intelligence value.

Either way, the attacks were so successful and so rapid that the hackers appear to have found a way to automate the process. “If you are running an Exchange server, you most likely are a victim,” he said.

Data from other security companies suggest that the scope of the attacks may not end up being quite that bad.

Researchers from Huntress examined about 3000 vulnerable servers on its partners’ networks and found about 350 infections, or just over 10 per cent.

While the SolarWinds hackers infected organisations of all sizes, many of the latest batch of victims are small-to medium-sized business and local government agencies.

Organisations that could be most affected are those that have an email server that’s running the vulnerable software and exposed directly to the internet, a risky setup that larger ones usually avoid.

Smaller organisations are “struggling already due to COVID shutdowns – this exacerbates an already bad situation,” said Jim McMurry, founder of Milton Security Group Inc, a cybersecurity monitoring service. “I know from working with a few customers that this is consuming a great deal of time to track down, clean and ensure they were not affected outside of the initial attack vector.”

Mr McMurry said the issue is “very bad” but added that the damage should be mitigated somewhat by the fact that “this was patchable, it was fixable”.

Microsoft said customers that use its cloud-based email system are not affected.

The use of automation to launch very sophisticated attacks may mark a new, frightening era in cybersecurity, one that could overwhelm the limited resources of defenders, experts said.

Some of the initial infections appear to have been the result of automated scanning and installation of malware, said Alex Stamos, a cybersecurity consultant. Investigators will be looking for infections that led to hackers taking the next step and stealing data such as email archives and searching them for any valuable information later, he said.

“If I was running one of these teams, I would be pulling down email as quickly as possible indiscriminately and then mining them for gold,” Stamos said.

Bloomberg



Original Source link

Leave a Reply

Your email address will not be published. Required fields are marked *

fifty one + = 60