By Sergiu Gatlan November 28, 2023 02:01 PM

Opinion:Proably does not surprise you

Today, Microsoft shared a temporary fix for a known issue causing Outlook Desktop to crash when sending emails from Outlook.com accounts.

This confirms customer reports regarding crashing issues when using Outlook.com accounts shared on Microsoft’s community website and other social networks since last Monday, November 20.

According to online reports, restarting, repairing Outlook, reinstalling the application, and creating a fresh Outlook profile for the impacted email account fails to address the issue.

“I’ve tried everything (safe mode, new profile, repair pst, even up to and including a system restore to attempt to roll back a previous installation) to no avail,” one of the affected users said.

These problems only affect Outlook for Microsoft 365 users and those in the Current Channel (Preview) channel using Outlook build 17029.20028.

“The issue is fixed in future builds 17029.20052+. However, this build has not been released yet,” Microsoft said.

While a limited number of customers did report they had successfully worked around this known issue by reinstalling Office, Microsoft suggests reverting to an earlier version.

To do that, type Command Prompt in the Windows search box, right-click Command Prompt and click Run as administrator.

Next, paste the following commands into the Command Prompt window and hit Enter after each:

cd %programfiles%\Common Files\Microsoft Shared\ClickToRun

officec2rclient.exe /update user updatetoversion=16.0.16924.20124

Redmond also started rolling out fixes last week for some of the customers affected by another known Microsoft 365 issue behind ‘Something Went Wrong [1001]’ sign-in errors, rendering desktop Office apps unusable for many affected users.

These ongoing login issues impact customers using Excel, Word, Outlook, and PowerPoint for Microsoft 365, Microsoft 365 Apps for business, and Office apps for iOS and Android, as the company confirmed over a month ago.

Previously, it fixed another bug causing significant delays for Microsoft 365 customers when saving attachments in Outlook Desktop to a network share.

Earlier this year, Microsoft tackled various other Outlook issues, including ones blocking Microsoft 365 customers from accessing emails and calendars and causing slow starts and freezes during cache re-priming.

Article (https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-temp-fix-for-outlook-crashes-when-sending-emails/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

By Bill Toulas November 27, 2023 09:52 AM

My comment: Between Google and Microsoft I have no idea if you are in the frying pan or the fire. Persoanlly I would ask for a full refund if not fixed with 72 hours. I am sure some lawyer will create a class action

Google Drive users are reporting that recent files stored in the cloud have suddenly disappeared, with the cloud service reverting to a storage snapshot as it was around April-May 2023.

Google Drive is a cloud-based storage service that allows people to store and access files from any internet-connected device via their Google account. It is a widely used service by individuals and businesses (as part of Google Workspace).

A trending issue reported on Google’s support forums starting last week describes a situation where people say they lost recent data and folder structure changes.

“There is a serious issue here that needs to escalate urgently. We have a support ticket open, this has not been helpful to date,” said a Google Drive user on the support thread.

“I pay extra each month to store folders in the cloud so that it is safe, so it is devastating that all my work appears to have been lost,” another Google Drive user posted.

The activity logs on impacted accounts do not show any recent changes, confirming that the users themselves didn’t accidentally delete them.

Overall, there are no indications of a user error but rather a problem with the service’s system that prevented the synchronization of data between the local devices and Google Cloud at some point.

Some users have offline caches that might contain the missing data, but no known method exists to restore access to the data within them.

Google’s volunteer support agents have posted an alleged response from Google’s support engineers that confirms they are already investigating the issue. However, an estimate for a fix hasn’t been provided yet.

“Please accept my sincere apologies if I’m unable to join the Google Meet session. I am continously tracking this case and to be transparent with you we totally agree now that you are not the only customer affected by this behavior.

Aside from the thread link you provided there are other admins now that have reported the same behavior we encounter where after the update there are files that went missing. This is now being investigated by our Product Engineers and we are also waiting for a root cause analysis as well on how we can fix it. Due to the ongoing investigation we are unable to provide an ETA yet.

We don’t recommend as well to make changes on the root/data folder while we wait for instructions from our Engieers. I will continue to monitor the behavior of reported issue from other admins and schedule a callback tommorow same time hoping there are progress within the day that I can deliver before our Google Meet session.” – Google Support Team.

The recommendation for those affected is to avoid making changes to the root/data folder until the situation clears up and the root cause of the problem is determined.

Understandably, many users are frustrated by the loss of critical data they entrusted to the cloud-based service and, in many cases, paid for the hosting of their files.

A notable aspect of the situation is that Google’s support forums are backed by volunteers with limited insight or understanding of the cloud service, so the lack of effective assistance in critical problems like this makes it all the worse.

BleepingComputer has contacted Google for an update on the status of the internal investigation and whether the lost files are recoverable or irreversibly lost, but we have not received a response by publication time.

In this situation, Google Drive users should refrain from changing their cloud storage as it might complicate the recovery process. Instead, your best bet would be to contact Google Support, open a new case, and monitor for official updates.

Until the problem is resolved, it would be more prudent to backup important files locally or use a different cloud service.
Article (https://www.bleepingcomputer.com/news/google/google-drive-users-angry-over-losing-months-of-stored-data/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

This could affect the economy

By Bill Toulas November 13, 2023 02:06 PM

A cyberattack on international logistics firm DP World Australia has severely disrupted the regular freight movement in multiple large Australian ports.

DP World has an annual revenue of over $10 billion and specializes in cargo logistics, port terminal operations, maritime services, and free trade zones.

It is responsible for operating 82 marine and inland terminals in 40 countries. It handles about 70 million containers carried annually by 70,000 vessels, corresponding to roughly 10% of the global container traffic.

DP World has a significant presence in Australia, handling 40% of the nation’s container trade. It operates logistics terminals in the ports of Bing Bong, Fremantle, Brisbane, Sydney, and Melbourne.

According to a statement the firm shared with BleepingComputer, a cyberattack on Friday, November 10 disrupted landside freight operations at its ports.

In response, the company activated its emergency plans and engaged with cybersecurity experts to overcome problems caused by the incident. It is currently testing key systems required to resume normal business operations.

Since Friday, roughly 30,000 shipping containers of varying importance and value remained unmoved and crowded to the brim the available storage spaces. At the moment, operations are being restored gradually.

The estimated damages are in the millions of dollars, as many of the stranded containers hold time-sensitive goods such as blood plasma, wagyu beef, and lobsters
Article (https://www.bleepingcomputer.com/news/security/dp-world-cyberattack-blocks-thousands-of-containers-in-ports/)

Related Articles:

Pizza Hut Australia warns 193,000 customers of a data breach
Article (https://www.bleepingcomputer.com/news/security/pizza-hut-australia-warns-193-000-customers-of-a-data-breach/)

Pharmacy provider Truepill data breach hits 2.3 million customers
Article (https://www.bleepingcomputer.com/news/security/pharmacy-provider-truepill-data-breach-hits-23-million-customers/

Maine govt notifies 1.3 million people of MOVEit data breach
Article (https://www.bleepingcomputer.com/news/security/maine-govt-notifies-13-million-people-of-moveit-data-breach/)

McLaren Health Care says data breach impacted 2.2 million people
Article (https://www.bleepingcomputer.com/news/security/mclaren-health-care-says-data-breach-impacted-22-million-people/)

Kyocera AVX says ransomware attack impacted 39,000 individuals
Article (https://www.bleepingcomputer.com/news/security/kyocera-avx-says-ransomware-attack-impacted-39-000-individuals/)

Microsoft fixes critical Azure CLI flaw that leaked credentials in logs What a leak
Article (https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-critical-azure-cli-flaw-that-leaked-credentials-in-logs/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

1) SEC Charges Against SolarWinds CISO Send Shockwaves Through Security Ranks
The legal actions may have a chilling effect on hiring CISOs, who are already in short supply, but may also expose just how budget-constrained most security executives are.
Article (https://www.darkreading.com/attacks-breaches/sec-charges-against-solarwinds-ciso-send-shockwaves-through-security-ranks?_mc=NL_DR_EDT_DR_weekly_20231102&cid=NL_DR_EDT_DR_weekly_20231102&sp_aid=119087&elq_cid=34964379&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_cid=50368)

2) Boeing Confirms Cyberattack, System Compromise
The aerospace giant said it’s alerting customers that its parts and distribution systems have been impacted by cyberattack.
Article (https://www.darkreading.com/endpoint/boeing-confirms-system-compromise-alerting-customers?_mc=NL_DR_EDT_DR_weekly_20231102&cid=NL_DR_EDT_DR_weekly_20231102&sp_aid=119087&elq_cid=34964379&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_cid=50368)

3) Boeing Breached by Ransomware, LockBit Gang Claims
LockBit gives Boeing a Nov. 2 deadline to pay the ransom or have its sensitive documents leaked to the public, but it hasn’t given evidence of the compromise.
Article (https://www.darkreading.com/endpoint/boeing-breached-ransomware-lockbit-gang-claims?_mc=NL_DR_EDT_DR_weekly_20231102&cid=NL_DR_EDT_DR_weekly_20231102&sp_aid=119087&elq_cid=34964379&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_cid=50368)

4) OpenAI confirms DDoS attacks behind ongoing ChatGPT outages
During the last 24 hours, OpenAI has been addressing what it describes as “periodic outages” linked to DDoS attacks affecting its API and ChatGPT services.
By Sergiu Gatlan November 09, 2023 03:18 AM
Article (https://www.bleepingcomputer.com/news/security/openai-confirms-ddos-attacks-behind-ongoing-chatgpt-outages/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

By Sergiu Gatlan October 11, 2023 12:10 PM 0

Microsoft is investigating Exchange Online mail delivery issues causing “Server busy” errors and delays when receiving emails from outside organizations.
According to user reports online, the Exchange Online problems started this morning, affecting Microsoft 365 customers worldwide, across the Americas, Europe, and Asia.
Microsoft confirmed the ongoing issues this morning, at 6 AM GMT+2, saying that “some users may encounter delays receiving external email messages in Exchange Online. Affected users may see a ‘451 4.7.500 Server busy’ error message.”
“We’re analyzing sample throttling IPs from simple messages to confirm whether the issue with the portion of SOL infrastructure is causing impact, before we begin formulating a remediation plan,” the company added.
“Impact is specific to some users who are served through the affected infrastructure.”
More information on these ongoing Exchange Online issues is available under EX680695 in the Microsoft 365 admin center.
Linked to IP-address anti-spam rules

In a subsequent update, Redmond said the cause of the issues could be linked to the erroneous enforcement of IP address anti-spam rules for affected customers.
“We’ve identified that a recent service update, applied to a section of infrastructure responsible for enforcing IP address anti-spam rules, contains a change which is inadvertently causing impact,” Microsoft said.
This confirms user reports saying that, in some cases, they’re seeing thousands of emails added to the outbound queue because of Exchange Online’s spam filter.
Microsoft has yet to confirm the regions affected by this Exchange Online outage and if it also impacts Exchange Online outgoing mail delivery.

Today’s incident follows Article emultiple Exchange Online outages since the start of the year,(https://www.bleepingcomputer.com/news/microsoft/new-microsoft-365-outage-causes-exchange-online-connectivity-issues/) blocking customers worldwide from accessing their mailboxes and sending or receiving emails.

Article (https://www.bleepingcomputer.com/news/microsoft/new-microsoft-365-outage-causes-exchange-online-connectivity-issues/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

We do have a solution..

By Sergiu Gatlan October 4, 2023 02:19 PM
Apple released emergency security updates to patch a new zero-day security flaw exploited in attacks targeting iPhone and iPad users.

“Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6,” the company said in an advisory issued on Wednesday.

The zero-day (CVE-2023-42824) is caused by a weakness discovered in the XNU kernel that enables local attackers to escalate privileges on unpatched iPhones and iPads.

While Apple said it addressed the security issue in iOS 17.0.3 and iPadOS 17.0.3 with improved checks, it has yet to reveal who found and reported the flaw.

The list of impacted devices is quite extensive, and it includes:

iPhone XS and later
iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later

Apple also addressed a zero-day tracked as CVE-2023-5217 and caused by a heap buffer overflow weakness in the VP8 encoding of the open-source libvpx video codec library, which could allow arbitrary code execution following successful exploitation.

The libvpx bug was previously patched by Google in the Chrome web browser and by Microsoft in its Edge, Teams, and Skype products.

CVE-2023-5217 was discovered by security researcher Clément Lecigne who is part of Google’s Threat Analysis Group (TAG), a team of security experts known for often finding zero-days abused in government-backed targeted spyware attacks targeting high-risk individuals.
17 zero-days exploited in attacks fixed this year

CVE-2023-42824 is the 17th zero-day vulnerability exploited in attacks that Apple has fixed since the start of the year.

Apple also recently patched three other zero-day bugs (CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993) reported by Citizen Lab and Google TAG researchers and exploited in spyware attacks to install Cytrox’s Predator spyware.

Citizen Lab disclosed two other zero-days (CVE-2023-41061 and CVE-2023-41064)—fixed by Apple last month—abused as part of a zero-click exploit chain (dubbed BLASTPASS) to infect fully patched iPhones with NSO Group’s Pegasus spyware.

Since January 2023, Apple has addressed a total of 17 zero-days exploited to target iPhones and Macs, including:

two zero-days (CVE-2023-37450 and CVE-2023-38606) in July
three zero-days (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439) in June
three more zero-days (CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373) in May
two zero-days (CVE-2023-28206 and CVE-2023-28205) in April
and another WebKit zero-day (CVE-2023-23529) in February

Today’s iOS 17.0.3 release also addresses a known issue causing iPhones running iOS 17.0.2 and lower to overheat.

“This update provides important bug fixes, security updates, and addresses an issue that may cause iPhone to run warmer than expected,” Apple said.

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

New Site Status Page (https://cloudstatus.mspportalpartners.net)

By Bill Toulas September 26, 2023 05:32 PM

OUTLOOK

Hackers are utilizing a new trick of using zero-point fonts in emails to make malicious emails appear as safely scanned by security tools in Microsoft Outlook.

Although the ZeroFont phishing technique has been used in the past, this is the first time it has been documented as used in this way.

In a new report by ISC Sans analyst Jan Kopriva, the researcher warns that this trick could make a massive difference in the effectiveness of phishing operations, and users should be aware of its existence and use in the wild.

ZeroFont attacks
The ZeroFont attack method, first documented by Avanan in 2018, is a phishing technique that exploits flaws in how AI and natural language processing (NLP) systems in email security platforms analyze text.

It involves inserting hidden words or characters in emails by setting the font size to zero, rendering the text invisible to human targets, yet keeping it readable by NLP algorithms.

This attack aims to evade security filters by inserting invisible benign terms that mix with suspicious visible content, skewing AI’s interpretation of the content and the result of security checks.

In its 2018 report, Avanan warned that ZeroFont bypassed Microsoft’s Office 365 Advanced Threat Protection (ATP) even when the emails contained known malicious keywords.

Hiding bogus antivirus scans
In a new phishing email seen by Kopriva, a threat actor uses the ZeroFont attack to manipulate message previews on widely used email clients such as Microsoft Outlook.

Specifically, the email in question displayed a different message in Outlook’s email list than in the preview pane.

As you can see below, the email listing pane reads “Scanned and secured by Isc®Advanced Threat protection (APT): 9/22/2023T6:42 AM,” whereas the beginning of the email in the preview/reading pane displays “Job Offer | Employment Opportunity.”
This discrepancy is achieved by leveraging ZeroFont to hide the bogus security scan message at the start of the phishing email, so while it’s not visible to the recipient, Outlook still grabs it and displays it as a preview on the email listing pane.

The goal is to instill a false sense of legitimacy and security in the recipient.

By presenting a deceptive security scan message, the likelihood of the target opening the message and engaging with its content rises.

It is possible that Outlook isn’t the only email client that grabs the first portion of an email to preview a message without checking if its font size is valid, so vigilance is advised for users of other software, too.

Article (https://www.bleepingcomputer.com/news/security/new-zerofont-phishing-tricks-outlook-into-showing-fake-av-scans/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

Updated on: 22 September 2023 by Vilius Petkauskas Deputy Editor
Article
(https://cybernews.com/news/tmobile-data-breach-new-hack/)

T-Mobile, the global telecoms giant, could be facing a third data breach in less than 12 months. Cybercriminals say they’ve exposed employee credentials, customer info, and other sensitive data.
T-Mobile, the Deutsche Telekom-owned brand with operating subsidiaries in the US, Poland, and other countries, could be heading for a rocky end to the year, with a third major data breach on its hands.
Threat actors posted a database on a cybercriminal forum, which they claim contains information stolen in April 2023. The post says the stolen data includes employee credentials, partial Social Security numbers (SSNs), email addresses, customer data, T-Mobile’s sales and analytics data, and other information.

The post advertising the leak is called “T-Mobile, Connectivity Source”. Connectivity Source is one of T-Mobile’s authorized retailers serving customers T-Mobile branded stores.

According to the Cybernews research team, the sample data that attackers posted appears legitimate. So far, there’s no confirmed information about what data the leaked dataset contains. However, the team said that attackers posted a massive amount of data, 90 GB in total.

Cybernews has reached out to T-Mobile for confirmation, however, we did not receive a reply before publishing this article.

According to malware researchers vx-underground, who claim to have insider knowledge about the breach, the data was stolen shortly after T-Mobile‘s second hack of this year, which occurred in March, 2023.

Also in March, the company disclosed a cyberattack in which attackers may have accessed T-Mobile account PINs, SSNs, full names, and other data. In January 2023, T-Mobile USA suffered a breach involving the accounts of 37 million of its cell phone users.

The company has suffered numerous data breaches in the past as well. In August 2021, T-Mobile reported a data breach after an online forum said that the personal data of more than 100 million of the company’s users was leaked.

Bleeping Computers Comments:
By Sergiu Gatlan
September 20, 2023 05:11 PM 2

T-Mobile app glitch let users see other people’s account info

T-Mobile says a cyberattack did not cause this incident, and its systems were not breached.

Also, despite the significant wave of customers reporting that they’ve been affected by this issue, T-Mobile says the incident had limited impact, only affecting less than 100 individuals.

“There was no cyberattack or breach at T-Mobile,” a spokesperson told BleepingComputer when asked for more details.

“This was a temporary system glitch related to a planned overnight technology update involving limited account information for fewer than 100 customers, which was quickly resolved.”
Nine data breaches since 2018
In May, T-Mobile disclosed the second data breach since the start of 2023 after hundreds of customers had their personal information exposed between late February and March after attackers hacked into the carrier’s systems.

In January, the mobile carrier revealed another data breach after the sensitive info of 37 million customers was stolen using one of its Application Programming Interfaces (APIs).

Since 2018, T-Mobile has been hit by seven other data breaches:

In August 2018, attackers accessed the data of around 3% of all T-Mobile customers.
In 2019, T-Mobile exposed the account info of an undisclosed number of prepaid customers.
In March 2020, T-Mobile employees were affected by a breach exposing their personal and financial information.
In December 2020, threat actors accessed customer proprietary network info (phone numbers, call records).
In February 2021, an internal T-Mobile app was accessed by unknown attackers without authorization.
In August 2021, hackers brute-forced their way through T-Mobile’s network following a breach of one of its testing environments.
In April 2022, the notorious Lapsus$ extortion gang breached T-Mobile’s network using stolen credentials.

Article (https://www.bleepingcomputer.com/news/security/t-mobile-app-glitch-let-users-see-other-peoples-account-info/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President
Security Software Distributor: Bitdefender , Barracuda, Axcient
“Where Service and Technical Skills Count”

The LockBit group is using native IT management software to live off the land, planting and then spreading itself before deploying its ransomware

Nate Nelson Contributing Writer, Dark Reading

The LockBit ransomware group is taking advantage of remote monitoring and management (RMM) software to spread its foothold in targeted networks.

Three recent attacks described in a report published Sept. 18 by Canada-based eSentire follow a similar trajectory: a LockBit affiliate either took advantage of exposed RMM instances, or brought their own RMM to the party, living off the land (LotL) in order to cement its footing in victim networks. Two of these cases affected manufacturers, and one struck a managed service provider (MSP), enabling the group to further compromise some of its downstream customers.

“There’s a general trend towards living off the land, where they’re just avoiding malware. Period. Even for initial access,” explains Keegan Keplinger, senior threat intelligence researcher with eSentire’s Threat Response Unit. “They want to get valid credentials, and use those legitimate credentials to get in.”

How LockBit Uses RMMs
In June, the Cybersecurity & Infrastructure Security Agency (CISA) published a cybersecurity advisory about LockBit, and for good reason. Arguably no cybercriminal outfit — in the ransomware-as-a-service game or otherwise — has been as prolific in 2023, with attacks seemingly targeting just about every possible sector, and every type of device, often yielding big money payouts.

The advisory details the group’s favored tactics, techniques, and procedures (TTPs), including its penchant for taking advantage of RMMs.

In a February 2022 attack against a home decor manufacturer, for example, eSentire’s threat researchers discovered a LockBit affiliate with admin access in an unprotected machine, attempting to establish persistence and spread to other computers via the RMM AnyDesk.

“Especially in the last year, threat actors have been pivoting to not using malware,” Keplinger explains, referring to how hackers establish persistence, and spread between and inside of networks. “Malware is often detected by antivirus, and if not, advanced endpoint technology. So anytime you can use either software that’s already in the environment, or software that could be conceivably legitimate, some people may not even recognize that as malicious right away.”

LockBit was counting on this in a June attack against a storage materials manufacturer, which counted itself a customer of the RMM ConnectWise. In this case, the researchers speculated that the threat actor was not able to steal credentials necessary to log into the company’s ConnectWise environment. So, instead, it installed its own, second instance of ConnectWise in the network.

“It’s pretty brilliant, because they said: ‘We already know ConnectWise is in this particular target organization. So, we’ll bring our own and nobody will really notice there’s another instance.'”

The Extent of the LockBit Threat
Organizations that enjoy the benefits of RMMs, without applying proper security controls to prevent their abuse, may expose not only themselves but also partners and customers, as LockBit’s MSP breach this February demonstrates.

The MSP in question had left its ConnectWise login panel exposed to the open Internet. The justification, the researchers speculated, was to make it easier for its customers’ IT administrators to access the service. But with brute force, or simply by purchasing them from the Dark Web, the attackers gained the necessary credentials to break through. Within five minutes of the intrusion, LockBit began dropping its ransomware binaries on multiple endpoints.

“They pretty much can go in unfettered when they get into those tools, and they get admin credentials,” Keplinger laments. Indeed, before it was stopped, the group had used the RMM’s remote access capabilities to reach customers in manufacturing, business services, hospitality, and transportation.

Companies can harden themselves against this kind of abuse by applying multi-factor authentication and strict access controls to these powerful tools. And, Keplinger adds, “endpoint monitoring is probably the biggest differentiator that’s stopping and preventing these attacks.”

“They’re very successful,” he warns of LockBit, for those not yet convinced. “Very pervasive, and very destructive.”

Article (https://www.darkreading.com/threat-intelligence/lockbit-using-rmms-spread-ransomware?_mc=NL_DR_EDT_DR_weekly_20230921&cid=NL_DR_EDT_DR_weekly_20230921&sp_aid=118309&elq_cid=34964379&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&sp_eh=949bacdba1e2c4851acc11df0ff47140b1c6468716621bc723fe5fe498198bd9&utm_source=eloqua&utm_medium=email&utm_campaign=DR_NL_Dark%20Reading%20Weekly_09.21.23&sp_cid=49896&utm_content=DR_NL_Dark%20Reading%20Weekly_09.21.23)

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Axcient

“Where Service and Technical Skills Count”

By Sergiu Gatlan September 18, 2023 11:18 AM
The Microsoft AI research division accidentally leaked dozens of terabytes of sensitive data starting in July 2020 while contributing open-source AI learning models to a public GitHub repository.

Almost three years later, this was discovered by cloud security firm Wiz whose security researchers found that a Microsoft employee inadvertently shared the URL for a misconfigured Azure Blob storage bucket containing the leaked information.

Microsoft linked the data exposure to using an excessively permissive Shared Access Signature (SAS) token, which allowed full control over the shared files. This Azure feature enables data sharing in a manner described by Wiz researchers as challenging to monitor and revoke.

When used correctly, Shared Access Signature (SAS) tokens offer a secure means of granting delegated access to resources within your storage account.

This includes precise control over the client’s data access, specifying the resources they can interact with, defining their permissions concerning these resources, and determining the duration of the SAS token’s validity.

“Due to a lack of monitoring and governance, SAS tokens pose a security risk, and their usage should be as limited as possible. These tokens are very hard to track, as Microsoft does not provide a centralized way to manage them within the Azure portal,” Wiz warned today.

“In addition, these tokens can be configured to last effectively forever, with no upper limit on their expiry time. Therefore, using Account SAS tokens for external sharing is unsafe and should be avoided.”

38TB of private data exposed via Azure storage bucket

The Wiz Research Team found that besides the open-source models, the internal storage account also inadvertently allowed access to 38TB worth of additional private data.

The exposed data included backups of personal information belonging to Microsoft employees, including passwords for Microsoft services, secret keys, and an archive of over 30,000 internal Microsoft Teams messages originating from 359 Microsoft employees.

In an advisory on Monday by the Microsoft Security Response Center (MSRC) team, Microsoft said that no customer data was exposed, and no other internal services faced jeopardy due to this incident.

Wiz reported the incident to MSRC on June 22nd, 2023, which revoked the SAS token to block all external access to the Azure storage account, mitigating the issue on June 24th, 2023.

“AI unlocks huge potential for tech companies. However, as data scientists and engineers race to bring new AI solutions to production, the massive amounts of data they handle require additional security checks and safeguards,” Wiz CTO & Cofounder Ami Luttwak told BleepingComputer.

“This emerging technology requires large sets of data to train on. With many development teams needing to manipulate massive amounts of data, share it with their peers or collaborate on public open-source projects, cases like Microsoft’s are increasingly hard to monitor and avoid.”

BleepingComputer also reported one year ago that, in September 2022, threat intelligence firm SOCRadar spotted another misconfigured Azure Blob Storage bucket belonging to Microsoft, containing sensitive data stored in files dated from 2017 to August 2022 and linked to over 65,000 entities from 111 countries.

SOCRadar also created a data leak search portal named BlueBleed that enables companies to find out if their sensitive data was exposed online.

Microsoft later added that it believed SOCRadar “greatly exaggerated the scope of this issue” and “the numbers.”

ARTICLE (https://www.bleepingcomputer.com/news/microsoft/microsoft-leaks-38tb-of-private-data-via-unsecured-azure-storage/)

Roy Miehe | MspPortal Partners Inc. | Ceo/President

Security Software Distributor: Bitdefender , Barracuda, Axcient

“Where Service and Technical Skills Count”