Microsoft probing if Exchange attack is inside job, Feds shoring up security

Posted:
in General Discussion
Microsoft is investigating whether a potential leak made the Exchange server attacks worse as the Biden Administration outlined plans to beef up government cybersecurity.

Credit: Microsoft
Credit: Microsoft


The technology giant is specifically launching a probe examining whether "sensitive information" was leaked through private disclosures that Microsoft made with some of its security partners, The Wall Street Journal reported Monday.

More specifically, the company is investigating whether proof-of-concept code that sent privately by Microsoft to members of its Microsoft Active Protections Program (MAPP) was leaked, either intentionally or accidentally. There are about 80 organizations that participate in MAPP.

Earlier in March, Microsoft issued emergency patches for four zero-day vulnerabilities in Exchange email servers that were being actively exploited.

Microsoft identified issues in January, and shared proof-of-concept attack code with at least some MAPP partners on Feb. 23, before the patches were released. The probe indicates that some of the tools used in the Exchange attacks have "similarities" to the private code.

The Exchange attacks targeted at least 30,000 organizations in the U.S., including many prominent businesses. The initial wave of attacks were carried out by a Chinese hacker group named Hafnium, but the vulnerabilities are now also being leveraged by other criminal organizations.

On March 11, a security researcher briefly published proof-of-concept code exploiting the vulnerabilities to Microsoft-owned GitHub. That code was quickly taken down. Just a day after that, security researchers and federal agencies began warning that the vulnerabilities were being used to deliver ransomware on compromised machines.

In the wake of the Microsoft Exchange campaign and the SolarWinds attack in late 2020, the government is taking action. On March 12, The White House released a transcript of a briefing between press members and a senior administration official outlining its plans to respond to the cybersecurity incidents.

The senior official says the Biden Administration wants to prioritize security in the way that U.S. companies build and buy software. The centerpiece of its cybersecurity response will reportedly focus on closer collaboration with the private sector.

"Today, the cost of insecure technology is borne at the end: by incidence response and cleanup. And we really believe it will cost us a lot less if we build it right at the outset," the official said.

Additionally, the official added that the government is currently in week three of a four-week remediation in response to the Exchange and SolarWinds attacks.

"The compromised agencies all were tasked to do a particular set of activities and then were tasked to have an independent review of their work to ensure that we felt confident the adversary had been eradicated," the official said. "Most of the agencies have completed that independent review. For those who have not yet, they will complete it by the end of March."

Stay on top of all Apple news right from your HomePod. Say, "Hey, Siri, play AppleInsider," and you'll get latest AppleInsider Podcast. Or ask your HomePod mini for "AppleInsider Daily" instead and you'll hear a fast update direct from our news team. And, if you're interested in Apple-centric home automation, say "Hey, Siri, play HomeKit Insider," and you'll be listening to our newest specialized podcast in moments.
patchythepirate

Comments

  • Reply 1 of 8
    tzeshantzeshan Posts: 2,351member
    Good article!
  • Reply 2 of 8
    gweedogweedo Posts: 1member
    "...the government is taking action."
    Probably the most concerning part of the article.

    watto_cobra
  • Reply 3 of 8
    Wonderful. Thank you Chinese ccp. I work at a major medical institution in Houston, and I'm completely locked out of my email, which I rely on quite a bit to coordinate patient care. Hopefully they can't access encrypted emails. And I just finished a great presentation on commercial sexual exploitation of youth, you're welcome ccp. Also, I wonder if biden is getting some sort of kickback for this from the ccp.
    watto_cobra
  • Reply 4 of 8
    nicholfdnicholfd Posts: 560member
    Wonderful. Thank you Chinese ccp. I work at a major medical institution in Houston, and I'm completely locked out of my email, which I rely on quite a bit to coordinate patient care. Hopefully they can't access encrypted emails. And I just finished a great presentation on commercial sexual exploitation of youth, you're welcome ccp. Also, I wonder if biden is getting some sort of kickback for this from the ccp.
    WTF?  You do realize all this started before Biden was elected, right?
    watto_cobrajony0
  • Reply 5 of 8
    GeorgeBMacGeorgeBMac Posts: 9,401member
    nicholfd said:
    Wonderful. Thank you Chinese ccp. I work at a major medical institution in Houston, and I'm completely locked out of my email, which I rely on quite a bit to coordinate patient care. Hopefully they can't access encrypted emails. And I just finished a great presentation on commercial sexual exploitation of youth, you're welcome ccp. Also, I wonder if biden is getting some sort of kickback for this from the ccp.
    WTF?  You do realize all this started before Biden was elected, right?
    Haters got to hate.
    They don't care if it's China, Biden, Socialists, or Potato heads.

    Otherwise they have to face up to their own faults and deficiencies.

    jony0
  • Reply 6 of 8
    GeorgeBMacGeorgeBMac Posts: 9,401member
    Their China excuse continues to unravel.
  • Reply 7 of 8
    crowleycrowley Posts: 7,806member
    Also, I wonder if biden is getting some sort of kickback for this from the ccp.
    Jfc, this is some higher level nonsense.
    GeorgeBMac
  • Reply 8 of 8
    jony0jony0 Posts: 344member
    Wonderful. Thank you Chinese ccp. I work at a major medical institution in Houston, and I'm completely locked out of my email, which I rely on quite a bit to coordinate patient care. Hopefully they can't access encrypted emails. And I just finished a great presentation on commercial sexual exploitation of youth, you're welcome ccp. Also, I wonder if biden is getting some sort of kickback for this from the ccp.
    Donny ? Is that you ?
Sign In or Register to comment.