Security flaws at UK elections agency left door open for Chinese hackers, privacy watchdog finds
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-31207 | Security feature bypass in Microsoft Exchange Server (ProxyShell) enables webshell RCE CVE-2021-31207 is a security feature bypass in Microsoft Exchange Server, classified as an unrestricted file-write issue (CWE-434) that lets an attacker bypass intended restrictions and write files of their choosing to the server. It is the final bug in the ProxyShell chain: chained with the autodiscover SSRF and PowerShell backend elevation flaws, it allows an unauthenticated attacker to reach the Exchange PowerShell API, write arbitrary files such as an ASPX webshell, and execute code with SYSTEM privileges. A successful attacker gains full control of the on-premises Exchange server, including mailbox access, stolen credentials, and a foothold for lateral movement; the bug has been used to deploy ransomware and keyloggers. On-premises deployments of Microsoft Exchange Server (2013, 2016, and 2019 per vendor advisories) are affected, while Exchange Online/cloud mailboxes are not. Exploitation is essentially certain and ongoing: the flaw is in CISA's KEV (added 2021-11-03) with known ransomware use, public ProxyShell PoC/exploit code is available, and EPSS puts the 30-day exploitation probability at 99.8%. Do: Apply Microsoft's July 2021 security updates for Exchange Server 2013, 2016, and 2019 (or any later security/cumulative update) per vendor instructions, and restrict untrusted access to Exchange's autodiscover and PowerShell endpoints. Hunt for ASPX webshells under the Exchange FrontEnd directories and review IIS logs for autodiscover.json requests chaining PowerShell, since many servers were compromised before patching. Given known ransomware use and KEV listing, treat any server that was unpatched or internet-exposed during the exploitation window as potentially compromised. | 6.6 | 100% | KEV ransomware PoC |
| massHundreds of thousands of on-premises Exchange servers (public scans around the July 2021 ProxyShell disclosure showed roughly 400,000-600,000 internet-exposed… | |
| CVE-2021-34473 +1 in the same advisory: …34523 | SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell) Microsoft Exchange Server contains a server-side request forgery (SSRF, CWE-918) in the Autodiscover service that unauthenticated remote attackers can reach over HTTP. This flaw is the first stage of the widely documented 'ProxyShell' chain, in which the SSRF is combined with privilege escalation and an arbitrary file write in the Exchange PowerShell backend to achieve unauthenticated remote code execution on the server. An attacker who successfully exploits it gains the ability to run code on the Exchange server, and ransomware operators (e.g., Cuba ransomware) leveraged this chain to deploy payloads. Organizations running on-premises Microsoft Exchange Server (2013, 2016, and 2019 per the vendor's advisories) are affected; hosted Exchange Online is a separately managed cloud service. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile). Do: Apply Microsoft's July 2021 (or later) Exchange Server security updates, which include the ProxyShell fixes, to all on-premises servers. If patching is delayed, restrict internet access to the Autodiscover/EWS frontend endpoints and consider the URL Rewrite mitigation Microsoft published for ProxyShell. Given the KEV listing and known ransomware use, treat internet-facing, unpatched Exchange servers as potentially compromised and hunt for webshells, unusual Exchange processes, and suspicious account or mailbox activity. | 9.1 group max | 100% | KEV ransomware PoC |
| masshundreds of thousands of on-prem Exchange servers; public internet scans at the time of disclosure showed roughly 400,000+ internet-exposed Exchange instances,… |
Full article483 words · extracted from therecord.media · click to collapse
The United Kingdom’s privacy watchdog reprimanded the country’s Electoral Commission on Tuesday for failing to protect the personal information of nearly 40 million people accessed by hackers during a cyberattack three years ago. According to the Information Commissioner’s Office (ICO), the election agency failed to ensure its systems were kept up to date with the latest security updates and did not have sufficient password policies. “If the Electoral Commission had taken basic steps to protect its systems, such as effective security patching and password management, it is highly likely that this data breach would not have happened,” ICO Deputy Commissioner Stephen Bonner said in a statement on Tuesday. During an attack in 2021, the threat actor accessed the personal information, including names and home addresses, of people registered to vote in the U.K. beginning in 2014. In March, the U.K.’s National Cyber Security Centre (NCSC) attributed the breach to a Chinese state-backed hacker group named APT31. According to the ICO, the hackers successfully accessed the Electoral Commission’s Microsoft Exchange Server by impersonating a user account and exploiting known software vulnerabilities in the system that had not been secured. In particular, the threat actor gained access to the on-premise Microsoft server via a ProxyShell vulnerability chain, which consisted of the following security flaws: CVE-2021-31207, CVE-2021-34523, and CVE-2021-34473. The patches for these vulnerabilities were released in April and May 2021, months before the attack, according to the ICO. Further investigation revealed eight more vulnerabilities on the Electoral Commission's servers. “Although not utilized on this occasion, any one of them could have been exploited by a threat actor whilst they existed on the relevant systems,” they said. The Electoral Commission also did not have proper password policies in place at the time of the attack, with many accounts still using passwords identical or similar to the ones originally allocated by the service desk. “This practice of reusing passwords makes the Electoral Commission's passwords highly susceptible to password guessing,” the ICO said. Following the breach, the Electoral Commission took a number of steps to improve its security, including implementing a plan to modernize its infrastructure, as well as password policy controls and multi-factor authentication for all users, according to the ICO. The reprimand “should serve as a reminder to all organizations that you must take proactive and preventative measures to ensure your systems are secure,” Bonner said. “Do you know if your organization has installed the latest security updates? If not, then you jeopardize people's personal information and risk enforcement action, including fines,” he added.
No previous article
No new articles
Daryna Antoniuk
is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/elections-agency-flaws-ico-hackers