Rob Wright: Welcome to TechTarget News Bytes. If
you're one of the many organizations that has
Microsoft Exchange Server in their environments,
then you may have heard about some of the "Proxy"
vulnerabilities affecting the widely used email
software, but you might not know the details. So
what are ProxyLogon, ProxyShell, and ProxyToken?
And why are all these Proxy flows in the
headlines? There's a lot to keep up with here. So
let's turn the clock back a bit and start at the
beginning. In December of 2020, a security
researcher at Dev core and infosec consultancy in
Taiwan discovered a critical authentication bypass
vulnerability in the on premise version of
Exchange Server. This vulnerability is known as
ProxyLogon. The researcher who goes by the name
Oren Sai also discovered a post authentication
arbitrary file rate bug that when chained with
proxy log on created a remote code execution
exploit. The vulnerabilities and proof of concept
exploit were reported to Microsoft. But just
before that occurred, threat, actors began
exploiting the zero days in the wild. Microsoft
later attributed the pre disclosure attacks to a
Chinese nation state threat group known as
hafnium. But the exploitation didn't stop with
that. Other thread actors began exploiting the
flaws in February, just prior to Microsoft's
disclosure of the bugs, and the Patch Tuesday
updates that fix them. Microsoft and deathcore
both conducted investigations but found no
evidence that a leak or theft of the vulnerability
info or PLCs had occurred. Despite the
considerable coverage of proxy log on because of
the apparent vulnerability leak, and the nation
state attacks on zero day vulnerabilities. Many
organizations did not patch a week after Microsoft
disclosed and patch the flaws that were still
around 80,000 Exchange servers that were
unpatched. And while that number went down during
the spring and summer months, there are still
several 1000 servers today that have not been
updated. I know that's a lot to keep up with. But
wait, there's more. Last month orange side
delivered presentations at both black hat and DEF
CON where he provided additional technical details
and background about proxy logger. The
presentation aptly named proxy log on is the tip
of the iceberg discussed other vulnerabilities in
Exchange Server including a remote code execution
flaw called proxy shell. On the bright side proxy
shell had already been reported to Microsoft and
patched a few months earlier, along with two other
companion vulnerabilities. However, after blackhat
and DEFCON two other security researchers used
orange sighs presentation to reverse engineer a
working PLC for proxy shell, which they published
to the internet. And soon after that proxy shell
attacks began. And just like with proxy log on
many Exchange servers were unpatched and
vulnerable to proxy shell attacks. And there's
more. Less than two weeks ago another Exchange
Server bug was discovered this time by a security
researcher and with the Vietnamese telecom company
vnpt. The bug known as proxy token is another
authentication bypass vulnerability that could
allow threat actors to perform configuration
actions on mailboxes. Microsoft patched the flaw
in July, and so far no widespread ax exploitation
has been observed. But around Labor Day weekend,
several threat researchers and vendors reported a
ramp up and exploitation activity of proxy shell
including attacks from the conky ransomware game.
As such, many organizations including Microsoft
and Sisa have issued advisories and urging
enterprises to patch immediately. So that's a lot
of proxies and info to keep up with but the good
news is, if you're up to date on your security
patches, then you're in pretty good shape.
Depending on when you apply those updates. You may
want to review your logs and look for any
suspicious activity in your environment. I'm Rob
Wright, security news director at TechTarget and
thanks for watching.