March 2021 Current Events

The Something Awful Forums > Discussion > Internet VFW > March 2021 Current Events

«‹›83 »

Wasabi the J: Jan 23, 2008; MOM WAS RIGHT

https://twitter.com/DEADLINE/status...ingawful.com%2F

But don't worry about the dead black people from cops.

# ? Mar 12, 2021 04:32

Adbot: ADBOT LOVES YOU

# ? Jun 10, 2024 15:08

Acebuckeye13: Nov 2, 2010; Against All Tyrants; Ultra Carp

Kesper North posted:

e: oh gently caress it nobody cares, make all the jokes you want, just know you're extremely uncreative and it did not spark joy

For the record I read the whole thing and I get it, it sucks to hear the same tired joke over and over when you're in a really lovely situation. I hope you and your SO are able to reunite as quickly as possible.

# ? Mar 12, 2021 04:47

Kesper North: Nov 3, 2011; EMERGENCY POWER TO PARTY

Acebuckeye13 posted:

For the record I read the whole thing and I get it, it sucks to hear the same tired joke over and over when you're in a really lovely situation. I hope you and your SO are able to reunite as quickly as possible.

Thanks friend. I really appreciate that. She's my bright star, and I miss her so much.

# ? Mar 12, 2021 05:08

Grip it and rip it: Apr 28, 2020

Wasabi the J posted:

https://twitter.com/DEADLINE/status...ingawful.com%2F

But don't worry about the dead black people from cops.

Did you watch the speech or are you commenting on the twitter byline??

# ? Mar 12, 2021 06:25

Bored As Fuck: Jan 1, 2006; Fun Shoe

Holy loving poo poo, another exploit was exposed, this time in Microsoft Exchange.

https://www.lawfareblog.com/microsoft-exchange-hack-and-great-email-robbery

According to the article, this could be just as big as Solar Winds.

quote:

As I write this, the world is probably days away from the �Great Email Robbery,� where a large number of threat actors around the globe are going to pillage and ransom the email servers of tens of thousands of businesses and local governments. Or at least pillage those that the purported Chinese actors haven�t already pillaged.

On Mar. 5, the investigative journalist Brian Krebs reported that an �unusually aggressive Chinese cyber espionage unit� had gained access to more than 30,000 U.S. organizations. The New York Times detailed on Mar. 6 that �The number of victims is estimated to be in the tens of thousands and could rise.� How did the attackers breach the companies? The Chinese actors developed a way to hack Microsoft Exchange and then attacked the organizations from there. And many of those attacked are still vulnerable to follow-on attacks not just by the Chinese but numerous criminals. The impact of the Exchange hack will certainly be greater than SolarWinds and researchers aren�t even close to the end of the story. But it�s a complicated story, with a lot to untangle.

What is Microsoft Exchange?

If you send an email, your computer contacts an email server. This server both stores your email and communicates with other email servers. A large number of companies outsource their mail servers to cloud-service companies like Microsoft or Google, commonly spending $6-12 per user per month. Your email account�firstname.lastname@companyx.com�may well rely on these Google or Microsoft servers.

Running a mail server is often difficult, so fraught with peril that many professional computing institutions (such as both the University of California Berkeley and the International Computer Science Institute, where I work) outsource our email to Google, others outsource it to Microsoft. Yet it is hard to argue with economics, so many companies will just run their own mail server, either buying the software from Microsoft or some other company. This can save $100,000 a year for a 1,000-person business.

Microsoft Exchange is one of the most popular mail servers because it works very well within a Windows environment. It also includes substantial features such as integration with voicemail, a webmail interface, and is practically guaranteed to work with Microsoft Outlook and Office.

Exchange centralizes all of a company�s emails. This means that if you compromise a company�s Microsoft Exchange server you can now see every email sent or received. This makes the mail server a very very tempting target for attackers. On Mar. 2, Microsoft released a series of patches for four exploits that were under active targeting by Chinese threat actors. Microsoft released the patches earlier than expected, opting not to wait for the traditional �Patch Tuesday.� Microsoft made the decision to go forward with the early release because the vulnerabilities were actively exploited; the early and unexpected release of the patch was an attempt to stop future exploitation.

What are the vulnerabilities?

The Chinese actors were not using a single vulnerability but actually a sequence of four �zero-day� exploits. The first allowed an unauthorized user to basically tell the server �let me in, I�m the server� by tricking the server into contacting itself. After the unauthorized user gained entry, the hacker could use the second vulnerability, which used a malformed voicemail that, when interpreted by the server, allowed them to execute arbitrary commands. Two further vulnerabilities allow the attacker to write new files, which is a common primitive that attackers use to increase their access: An attacker uses a vulnerability to write a file and then uses the arbitrary command execution vulnerability to execute that file.

Using this access, the attackers could read anybody�s email or indeed take over the mail server completely. Critically, they would almost always do more, introducing a �web shell,� a program that would enable further remote exploitation even if the vulnerabilities are patched.

What is the timeline?

The investigative journalist Brian Krebs has produced a handy timeline of events and a few things stand out from the chronology. The attacker was first detected by one group on Jan. 5 and another on Jan. 6, and Microsoft acknowledged the problem immediately. During this time the attacker appeared to be relatively subtle, exploiting particular targets (although we generally lack insight into who was targeted). Microsoft determined on Feb. 18 that it would patch these vulnerabilities on the March 9th �Patch Tuesday� release of fixes.

Somehow, the threat actor either knew that the exploits would soon become worthless or simply guessed that they would. So, in late February, the attacker changed strategy. Instead of simply exploiting targeted Exchange servers, the attackers stepped up their pace considerably by targeting tens of thousands of servers to install the web shell, an exploit that allows attackers to have remote access to a system. Microsoft then released the patch with very little warning on Mar. 2, at which point the attacker simply sought to compromise almost every vulnerable Exchange server on the Internet. The result? Virtually every vulnerable mail server received the web shell as a backdoor for further exploitation, making the patch effectively useless against the Chinese attackers; almost all of the vulnerable systems were exploited before they were patched.

This is a rational strategy for any actor who doesn�t care about consequences. When a zero-day is confidential and undiscovered, the attacker tries to be careful, only using it on attackers of sufficient value. But if the attacker knows or has reason to believe their vulnerabilities may be patched, they will increase the pace of exploits and, once a patch is released, there is no reason to not try to exploit everything possible.

So what is next?

Unfortunately these vulnerabilities are reportedly easy to exploit. To make matters worse, the patches that fix this problem provide a guide to reproducing the exploit. I would expect these exploits to be in criminal toolkits shortly and that the world is, at most, days away from ransomware gangs mass-exploiting Exchange servers, encrypting the contents, and offering the victims a choice: pay up, or your emails will be published for everyone else and deleted from your own servers.

Even patched servers aren�t out of the woods: There�s a very high probability that they were already compromised and a web shell installed before administrators applied the patches. Since the web shell is a backdoor into the server not removed by patches, the resulting systems remain vulnerable. This web shell can be used by the original installer or, possibly, by the same ransomware gangs about to mass-exploit the still unpatched servers.

So any company running an Exchange server, whether or not they might be a target of Chinese espionage, needs to look for and remove such backdoors. And those companies whose Exchange servers give way to even a remote chance for spying should probably rebuild their mail-servers completely. The web shell is simply the first of many possible backdoors the attacker might have installed.

And now the Biden administration has a real hard policy problem: What now? The SolarWinds hack may have been significant, but this will affect far more institutions. The SolarWinds hackers stayed subtle. They targeted traditional intelligence targets and never transitioned to a �pillage everything� model, which made that attack more of a �Spies Gonna Spy� operation. The Exchange attack showed complete disregard for possible consequences on behalf of those responsible for the breach.

Without consequences, such broad attacks will simply continue. There are currently no reasons why an attacker who has access to a zero-day shouldn�t simply press a button and exploit every possible target at the moment when they know their exploit is about to lose value. I don�t know how to change this calculus, but the U.S. must do so somehow.

# ? Mar 12, 2021 07:09

Godholio: Aug 28, 2002; Does a bear split in the woods near Zheleznogorsk?

Once again, I am glad to be boring as gently caress.

# ? Mar 12, 2021 07:42

Kesper North: Nov 3, 2011; EMERGENCY POWER TO PARTY

Yeah. I do digital forensics and incident response, and we've been turning 9-10 desperate clients away every day since that news broke due to sheer lack of capacity. We give them a detailed handout on what to do, because it's basically the same story in each case, but we can't actually work with them. And it's actually far worse than just an Exchange compromise, because on-prem Exchange service accounts have domain admin privileges - so congrats, it's not just Exchange, it's your entire domain that's been compromised and now you get to rebuild your entire network.

Hope your backups work!

And are clean!

And that you have backups!

# ? Mar 12, 2021 07:45

Milo and POTUS: Sep 3, 2017; I will not shut up about the Mighty Morphin Power Rangers. I talk about them all the time and work them into every conversation I have. I built a shrine in my room for the yellow one who died because sadly no one noticed because she died around 9/11. Wanna see it?

Acebuckeye13 posted:

It's pretty good, arguably the best of the Smithsonian cafeterias (Though AAHC is right up there as well) but it's geared towards tourists and relatively expensive as a result.

e: American Indian is a great museum in its own right though, there's one gallery that's just about broken treaties (there's a lot of them)

It's basically an infinity room!

# ? Mar 12, 2021 07:52

Suicide Watch: Sep 8, 2009

Bored As gently caress posted:

Holy loving poo poo, another exploit was exposed, this time in Microsoft Exchange.

https://www.lawfareblog.com/microsoft-exchange-hack-and-great-email-robbery

According to the article, this could be just as big as Solar Winds.

Lol, buttery males!

# ? Mar 12, 2021 07:59

Laranzu: Jan 18, 2002

CryptoLocker groups are rolling in on it now so kiss those already stolen emails goodbye.

# ? Mar 12, 2021 12:33

Wasabi the J: Jan 23, 2008; MOM WAS RIGHT

They definitely got NIPR right? Like lmao gently caress I'm so glad I'm quitting IT.

# ? Mar 12, 2021 12:43

Soylent Pudding: Jun 22, 2007; We've got people!

Exchange looks like it's going to be way, way worse than Solarwinds or Accellion. The thing about SW is that while they inserted a backdoor into the supply chain and compromised.tens of thousands, they did so "safely". Unless you were in the much smaller target set, the backdoor shut itself down after checking in. There was also no way for your average cybercrime group to replicate the attack since it was a complex supply chain operation and not a clever 0-day. There was also no way for for a third party to break in through the solarwinds backdoor.

Exchange on the other hand, it looks like the 0-day exploits leaked to several groups before the patch even dropped, multiple groups are automated them to hit every exchange server on the internet, and many of these groups are dropping a follow-up backdoor called a webshell. Most of these webshells are "off the shelf" components so to speak and they have no authentication. That means even if exchange is patched there is still a wide open door anyone on the internet can come waltzing through.

Basically Solarwinds was a guy breaking into the locksmith's and altering the mold to support a new master key. They then hit every house in the neighborhood but 90% didn't have what they wanted so they left and locked the door. Exchange is a guy discovering you can break a certain lock by hitting it just right with a screwdriver. They then went and busted every lock in the neighborhood.

# ? Mar 12, 2021 13:11

TCD: Nov 13, 2002; Every step, a fucking adventure.

Kesper North posted:

Yeah. I do digital forensics and incident response, and we've been turning 9-10 desperate clients away every day since that news broke due to sheer lack of capacity. We give them a detailed handout on what to do, because it's basically the same story in each case, but we can't actually work with them. And it's actually far worse than just an Exchange compromise, because on-prem Exchange service accounts have domain admin privileges - so congrats, it's not just Exchange, it's your entire domain that's been compromised and now you get to rebuild your entire network.

Hope your backups work!

And are clean!

And that you have backups!

I feel like this event is a giant sales pitch for O365 and Azure.

# ? Mar 12, 2021 13:32

bird food bathtub: Aug 9, 2003; College Slice

Well gently caress, I know what I'll be doing at work for like the next two weeks. Backups ahoy!

# ? Mar 12, 2021 13:39

ASAPI: Apr 20, 2007; I invented the line.

Wasabi the J posted:

They definitely got NIPR right? Like lmao gently caress I'm so glad I'm quitting IT.

Not touching computers was the best career move I have ever made. Less work, more pay. I don't understand how that works out.

# ? Mar 12, 2021 14:15

Mr. Nice!: Oct 13, 2005; bone shaking.
soul baking.

Soylent Pudding posted:

Exchange looks like it's going to be way, way worse than Solarwinds or Accellion. The thing about SW is that while they inserted a backdoor into the supply chain and compromised.tens of thousands, they did so "safely". Unless you were in the much smaller target set, the backdoor shut itself down after checking in. There was also no way for your average cybercrime group to replicate the attack since it was a complex supply chain operation and not a clever 0-day. There was also no way for for a third party to break in through the solarwinds backdoor.

Exchange on the other hand, it looks like the 0-day exploits leaked to several groups before the patch even dropped, multiple groups are automated them to hit every exchange server on the internet, and many of these groups are dropping a follow-up backdoor called a webshell. Most of these webshells are "off the shelf" components so to speak and they have no authentication. That means even if exchange is patched there is still a wide open door anyone on the internet can come waltzing through.

Basically Solarwinds was a guy breaking into the locksmith's and altering the mold to support a new master key. They then hit every house in the neighborhood but 90% didn't have what they wanted so they left and locked the door. Exchange is a guy discovering you can break a certain lock by hitting it just right with a screwdriver. They then went and busted every lock in the neighborhood.

Note that this is not an issue if your org uses office 365 and does not have their own exchange server.

# ? Mar 12, 2021 14:42

Flikken: Oct 23, 2009; 10,363 snaps and not a playoff win to show for it

Mr. Nice! posted:

Note that this is not an issue if your org uses office 365 and does not have their own exchange server.

Well.....gently caress

# ? Mar 12, 2021 15:09

Arven: Sep 23, 2007

Mr. Nice! posted:

Note that this is not an issue if your org uses office 365 and does not have their own exchange server.

Unfortunately, from what I have seen in the last decade, even most orgs that have migrated all of their users over to 365 probably still have an exchange server running for the half dozen legacy apps that are using it for smtp.

# ? Mar 12, 2021 15:10

Soylent Pudding: Jun 22, 2007; We've got people!

Mr. Nice! posted:

Note that this is not an issue if your org uses office 365 and does not have their own exchange server.

That's a good point to keep in mind.

For those less interested in the fiddly bits of computer touching but care about policies and norms of cyber conflict there is a strong argument that the Us should be holding solarwinds as an example of responsible and restrained espionage and treat the exchange shitfuckery as an irresponsible deviation from principles due to the latter's massive collateral impact.

I also just thought of this. But in the event of cyber conflict does an adversary like Russia or China even have to hack into all our stuff themselves or can they drop some of their 0day stash in darknet forums and let the ransomware gangs do the work of attacking at scale?

# ? Mar 12, 2021 15:16

Platystemon: Feb 13, 2012; BREADS

https://twitter.com/axios/status/1370346618889900033

If Marco Rubio told me the Pope was Catholic, I�d call the Vatican switchboard to check, but I don�t know what his play is here.

# ? Mar 12, 2021 15:36

facialimpediment: Feb 11, 2005; as the world turns

Platystemon posted:

If Marco Rubio told me the Pope was Catholic, I’d call the Vatican switchboard to check, but I don’t know what his play is here.

BIG TECH BAD

https://twitter.com/jbarro/status/1370382519561027590?s=19

Also he's looking to 2024 and playing this as a dumb "mavericky" thing because of polarization, when Rubio is a right-to-work union-busting gently caress.

# ? Mar 12, 2021 15:39

ASAPI: Apr 20, 2007; I invented the line.

Soylent Pudding posted:

That's a good point to keep in mind.

For those less interested in the fiddly bits of computer touching but care about policies and norms of cyber conflict there is a strong argument that the Us should be holding solarwinds as an example of responsible and restrained espionage and treat the exchange shitfuckery as an irresponsible deviation from principles due to the latter's massive collateral impact.

I also just thought of this. But in the event of cyber conflict does an adversary like Russia or China even have to hack into all our stuff themselves or can they drop some of their 0day stash in darknet forums and let the ransomware gangs do the work of attacking at scale?

I don't think we will immediately recognize a "cyber war" because of exactly what you pointed out.

I also believe that we are totally screwed if any actor goes "all in" with any kind of cyber attack. Everyone talks about these attacks like they are on a battlefield, but I don't think they realise just how asymmetric it really is.

# ? Mar 12, 2021 15:45

Fart Sandwiches: Apr 4, 2006; i never asked for this

ASAPI posted:

I don't think we will immediately recognize a "cyber war" because of exactly what you pointed out.

I also believe that we are totally screwed if any actor goes "all in" with any kind of cyber attack. Everyone talks about these attacks like they are on a battlefield, but I don't think they realise just how asymmetric it really is.

also any coordinated attack at any scale can take out huge chunks of infrastructure basically immediately because security is just that bad everywhere.

edit: and if a nation state wanted to do something crazy like cut ocean cables or anything else sufficiently dr. evil-esque you could trash the infrastructure and then lock everyone in behind you

# ? Mar 12, 2021 17:22

Nystral: Feb 6, 2002; Every man likes a pretty girl with him at a skeleton dance.

facialimpediment posted:

BIG TECH BAD

https://twitter.com/jbarro/status/1370382519561027590?s=19

Also he's looking to 2024 and playing this as a dumb "mavericky" thing because of polarization, when Rubio is a right-to-work union-busting gently caress.

He's up for reelection to the Senate in 22, unclear if anyone in FL GOP will run against him, and IIRC the FL Dems see DeSantis the easier opponent vs Rubio. So if this blows up its unlikely to impact him in a primary in 22 and forgotten about in the 24 primaries.

# ? Mar 12, 2021 17:25

facialimpediment: Feb 11, 2005; as the world turns

Somewhat possible that Biden was even underselling vaccine timing/availability last night too.

https://twitter.com/DavidEggert00/status/1370412252562653193?s=19

# ? Mar 12, 2021 17:36

mlmp08: Jul 11, 2004; Prepare for my priapic projectile's exalted penetration; Nap Ghost

https://twitter.com/vermontgmg/status/1370395395382259717?s=21

# ? Mar 12, 2021 17:44

Acebuckeye13: Nov 2, 2010; Against All Tyrants; Ultra Carp

facialimpediment posted:

Somewhat possible that Biden was even underselling vaccine timing/availability last night too.

https://twitter.com/DavidEggert00/status/1370412252562653193?s=19

Hey, I'm an adult in Michigan!

# ? Mar 12, 2021 17:50

RFC2324: Jun 7, 2012; http 418

mlmp08 posted:

https://twitter.com/vermontgmg/status/1370395395382259717?s=21

This is for anyone appalled at the state of our national cyber security

# ? Mar 12, 2021 17:56

A Bad Poster: Sep 25, 2006; Seriously, shut the fuck up.

Security is, and always has been, an illusion.

# ? Mar 12, 2021 18:01

Blind Rasputin: Nov 25, 2002; Farewell, good Hunter. May you find your worth in the waking world.

How do you all expect the Exchange attack to affect regular old consumer people? I imagine if they work for any business with an internal email server they could potentially have had their emails stolen? Emails are used for 2fa a lot.. so I could also imagine hackers using email access to break into other accounts people own and start identity/monetary theft stuff. I work for a hospital, we use exchange, I haven�t heard anything about this attack except for here, but I imagine we are affected to some extent.

# ? Mar 12, 2021 18:06

RFC2324: Jun 7, 2012; http 418

Blind Rasputin posted:

How do you all expect the Exchange attack to affect regular old consumer people? I imagine if they work for any business with an internal email server they could potentially have had their emails stolen? Emails are used for 2fa a lot.. so I could also imagine hackers using email access to break into other accounts people own and start identity/monetary theft stuff. I work for a hospital, we use exchange, I haven’t heard anything about this attack except for here, but I imagine we are affected to some extent.

If you have email 2fa pointed at your work email, I suggest changing that. If you have said anything in a work email that can be used against you, they could in theory use that to gently caress with you. Because this wasn't a single actor, but rather a bunch of amateur actors with serious access, they might stoop to kiwifarms type bullshit.

I mean, if you are entirely professional in your emails, you should be fine, but I know alot of people aren't.

Oh, and they are going to have to rebuild your entire computer network because exchange has domain administration privilege, so expect some disruption. As they turn everything attached to the domain off(which is how you log into the computer itself, and access files)

# ? Mar 12, 2021 18:20

Soylent Pudding: Jun 22, 2007; We've got people!

I'd assume that every company running exchange already had all your personal data stolen. Likewise some chunk of these orgs are gonna get hit with ransomware. So keep an eye on your credit and don't be surprised if your org / org you do business with gets their ops disrupted by ransomware and recovery thereof.

As far as using the email access to fuss with 2fa, I would imagine that would be reserved for high value targets, C levels, finance and accounting people with access to funds, etc. Though my focus isn't threat intel so take with a grain of salt.

# ? Mar 12, 2021 18:23

Blind Rasputin: Nov 25, 2002; Farewell, good Hunter. May you find your worth in the waking world.

drat, wow. Well luckily I�ve never used my hospital work email for anything but banal meetings and stuff. I kept my personal life all wrapped up in Gmail, which I imagine is not involved in this.

This just seems like a really scary, incredibly bad deal. But moreso, it seems to highlight yet again how vulnerable our country�s infrastructure and basically means of function is to any state-actor that wants to push buttons. And yeah, seems to me that �cyberwar� is extremely one-sided. The defender doesn�t know they are going to be attacked or even often know they�ve been attacked, until after the attack. Defending against that kind of thing seems difficult to say the least.

# ? Mar 12, 2021 18:36

Hot Karl Marx: Mar 16, 2009; Politburo regulations about social distancing require to downgrade your Karlmarxing to cold, and sorry about the dnc primaries, please enjoy!

https://twitter.com/maggieNYT/statu...ingawful.com%2F

AOC and other New York reps have told Cuomo to resign and that's his response

# ? Mar 12, 2021 19:14

That Works: Jul 22, 2006; Every revolution evaporates and leaves behind only the slime of a new bureaucracy

Sounds like he's just gonna post through it.

# ? Mar 12, 2021 19:21

Hot Karl Marx: Mar 16, 2009; Politburo regulations about social distancing require to downgrade your Karlmarxing to cold, and sorry about the dnc primaries, please enjoy!

Wrong thread; Cuomo bad

# ? Mar 12, 2021 19:23

maffew buildings: Apr 29, 2009; too dumb to be probated; not too dumb to be autobanned

As an Italian-American I can not state emphatically enough we should return to this nation's roots of vehement anti-Italian sentiment

# ? Mar 12, 2021 19:24

Marshal Prolapse: Jun 23, 2012; by Jeffrey of YOSPOS

So one of our friends just texted me to say her sister just got her stimulus money...that was fast.

# ? Mar 12, 2021 19:25

That Works: Jul 22, 2006; Every revolution evaporates and leaves behind only the slime of a new bureaucracy

https://twitter.com/rhinosoros/status/1370440012337197056?s=20

# ? Mar 12, 2021 19:27

Adbot: ADBOT LOVES YOU

# ? Jun 10, 2024 15:08

Blind Rasputin: Nov 25, 2002; Farewell, good Hunter. May you find your worth in the waking world.

If the past year has taught these people anything it�s that constituents actually do have the memory of a goldfish, and if they can lie low for about two months while the news cycle moves on to other awful societal and economic disasters the public will forget that they wanted to hold the person accountable for something. It�s disgusting.

# ? Mar 12, 2021 19:27

The Something Awful Forums > Discussion > Internet VFW > March 2021 Current Events

«‹›83 »