Tag Archive for: Email

Trail of Errors Led to Chinese Hack of Microsoft Cloud Email

/in


Cyberwarfare / Nation-State Attacks
,
Encryption & Key Management
,
Fraud Management & Cybercrime

Crash Dump Snapshot Included Active Signing Key

Mihir Bagwe (MihirBagwe) •
September 7, 2023    

Trail of Errors Led to Chinese Hack of Microsoft Cloud Email
Image: Shutterstock

Chinese hackers were able to access the email accounts of senior U.S. officials after Microsoft included an active digital signing key in a snapshot of data taken to analyze a crash of its consumer signing system in April 2021.

See Also: Live Webinar | Unmasking Pegasus: Understand the Threat & Strengthen Your Digital Defense

Inclusion of the key in the crash dump was just one of many mishaps leading to a China-based espionage hacking group Microsoft tracks as Storm-0558 gaining access to email accounts tied to 25 different organizations, including the U.S. Departments of State and Commerce (see: Hackers Stole Signing Key, Hit US Government’s Microsoft 365).

Microsoft detailed the chain of events leading to the hack in a Wednesday blog post. The email hacks started May 15 and went undetected for a month, coinciding with a European Parliament meeting on China policy and U.S. diplomatic trips to China. Tensions between the U.S. and China are mounting amid concern over Chinese aggression in the South China Sea and American steps to restrict Beijing’s access to advanced technology (see: US Restricts Investment in Chinese AI, Other Technologies).

The computing giant has previously acknowledged that the Chinese hackers were able to create their own authentication tokens to access cloud-based Outlook email accounts using a digital key from Microsoft’s signing system.

The crash dump contained the…

Source…

US government to investigate China’s Microsoft email breach • The Register

/in


Infosec in brief The July breach of Microsoft Exchange Online by suspected Chinese hackers is the next topic up for review by the Department of Homeland Security’s Cyber Safety Review Board (CSRB). 

DHS secretary Alejandro Mayorkas announced the review last Friday, saying it would assess the Microsoft intrusion, as well as conducting a broader review of identity and authentication infrastructure used by cloud providers. 

“Organizations of all kinds are increasingly reliant on cloud computing to deliver services to the American people, which makes it imperative that we understand the vulnerabilities of that technology,”  Majorkas said. 

This will be the third investigation by the recently formed CSRB. It first reviewed Log4j vulnerabilities discovered in 2021, concluding the exploit would likely be a problem for at least a decade. Its second report, which was released earlier this week, focused on the threats from hacking group Lapsus$. In that report, the CSRB said the international cyber crime group used “simple techniques” to evade security tools, and offered ten recommendations for hardening environments against such attackers. 

The decision to investigate the July Outlook intrusion, and cloud security more broadly, was welcomed by senator Ron Wyden (D-OR), who last week blamed Microsoft for its failure to protect cloud accounts belonging to US government officials and called for the CSRB to investigate the incident. 

“I applaud president Biden and CISA director Easterly for acting on my request for the board to review this recent espionage campaign, including cyber security negligence by Microsoft that enabled it,” Wyden said. “The government will only be able to protect federal systems against cyber attacks by getting to the bottom of what went wrong. Ignoring problems is both a waste of taxpayer dollars and a massive gift to America’s adversaries.”

CISA director Jen Easterly said the CSRB’s findings would help advance cyber security across the cloud – both government and enterprise. 

It’s worth noting that the CSRB has no regulatory or enforcement powers. Rather, “its purpose is to identify relevant lessons learned to inform future improvements,”…

Source…

Microsoft’s role in government email hack under cyber-inquiry scrutiny

/in


In a recent development that rattled the cyber world, Microsoft found itself in the crosshairs of a U.S. cyber inquiry after a breach of government officials’ email accounts. The planned investigation by a cybersecurity advisory panel will include an examination of the software giant’s role in the hack, which is suspected to be done by Chinese hackers.

The Cyber Safety Review Board, under the Biden administration, is set to focus broadly on risks to cloud computing infrastructure, Bloomberg reported.

According to a Department of Homeland Security official, as quoted by Bloomberg, the board will delve into identity and authentication management, looking into all relevant cloud service providers.

The cyber breach gave rise to vocal criticism from lawmakers like Senator Ron Wyden, who wrote to Attorney General Merrick Garland, Federal Trade Commission Chair Lina Khan, and Director of the Cybersecurity and Infrastructure Security Agency Jen Easterly.

In his letter, Senator Wyden firmly suggested that Microsoft’s cybersecurity procedures were sloppy and required a thorough investigation.

The public scrutiny surrounding Microsoft’s cybersecurity practices isn’t new. Recently, the company faced increasing criticism from computer security experts and government agencies who questioned the adequacy of its customer protection measures against breaches.

The email hack resonated powerfully because it occurred shortly before Secretary of State Antony Blinken’s planned trip to meet President Xi Jinping of China. Additionally, the hack utilized a Microsoft consumer signing key, which enabled the hackers to penetrate the networks and obtain entry to the officials’ emails.

In response, Microsoft committed to making 31 critical security logs accessible to licensees of the company’s lower-cost cloud services from September onwards to tighten their cybersecurity measures. The company also plans to extend the retention period for security logs from 90 to 180 days.

This tale underpins the need for relentless vigilance and rigorous security protocols in our increasingly connected world. It serves as a stern reminder of how even the giants of the tech world can stumble when it comes to…

Source…

Hackers exploit Salesforce email zero-day for Facebook phishing campaign

/in


The threat actors used a vulnerability named “PhishForce” to conceal malicious email traffic in Salesforce’s legitimate email gateway services, capitalising on Salesforce and Meta’s size and reputation.

The attackers managed to evade conventional detection methods by “leveraging Salesforce’s domain and reputation and exploiting legacy quirks in Facebook’s web games platform,” the researchers added.

Salesforce has around 150,000 clients, a significant number of which are small businesses. Security vulnerabilities like these could be especially detrimental to SMBs, up to and including the closure of their business, if hackers get access to their sensitive data.

The Email Gateway feature is an important part of the Salesforce CRM. It consists of specialised servers dedicated to efficiently sending a large volume of email notifications and messages to customers worldwide.

Customers using the Salesforce CRM can send emails under their own brand by using custom domains. However, to ensure security and prevent abuse, the system follows a process of validating the ownership of the domain name before allowing emails to be sent.

The validation step ensures that only legitimate and authorised users can use custom domains for sending emails through the Salesforce platform.

In this phishing campaign, however, the fraudulent email messages appeared to come from Meta, while actually being sent from an email address with a “@salesforce.com” domain.

The campaign’s primary objective is to trick recipients into clicking on a link by claiming their Facebook accounts are under investigation, due to alleged involvement in impersonation activities (oh, the irony).

Upon clicking the embedded button, the victim is redirected to a rogue landing page hosted and displayed as part of the Facebook gaming platform (“apps.facebook.com”).

This tactic adds further legitimacy to the attack, making it significantly more challenging for email recipients to discern the page’s fraudulent nature.

The landing page is designed to capture the victim’s account credentials, as well as any two-factor authentication (2FA) codes they might enter.

Swift response

Upon replicating the creation of a Salesforce-branded address…

Source…