Cyberespionage group stolen Microsoft vulnerabilities DB back in 2013
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2013-0422 | Java Applet Permission-Restriction Flaw Enables Remote Code Execution in Oracle JRE CVE-2013-0422 is a flaw in how Oracle's Java Runtime Environment restricts the permissions of Java applets (CWE-264), allowing an applet to run with privileges beyond its intended security sandbox. It is triggered when a user loads a web page that delivers a malicious Java applet, such as via a drive-by visit or a phishing link pointing to an attacker-controlled site. Successful exploitation lets the attacker execute commands in the context of the current user on the client system, which in the 2013 campaigns was used to deliver malware families tracked in exploit kits and APT activity (e.g., Whitehole, Miniduke, Icefog) and is recorded by CISA as being used in ransomware. Any system with Oracle JRE installed—especially workstations and browsers with the Java applet plug-in enabled—is affected. Exploitation is confirmed in the wild: the flaw was mass-exploited by exploit kits at the time of disclosure, it carries a 97.6% EPSS probability of exploitation (100th percentile), and it was added to CISA KEV on 2022-05-25, so patching remains an active requirement. Do: Apply Oracle's Java updates per vendor instructions — at disclosure this meant the emergency Java 7 Update 11 or later, and today the current supported Java release. As interim mitigation, disable the Java browser plug-in (or Java in browsers) and uninstall JRE where it is no longer needed. Given known in-the-wild use by exploit kits and ransomware, prioritize KEV remediation and check endpoints for drive-by web-borne infections delivered via malicious applets. | — | 98% | KEV ransomware |
| masshundreds of millions of Java installs (Java was near-ubiquitous on enterprise desktops and servers in 2013) |
Full article621 words · extracted from securityaffairs.com · click to collapse
Another day, another news about a clamorous data breach, this time the Reuters agency revealed that Microsoft suffered a major security breach back in 2013.
According to five former employees, hackers broke into the company vulnerabilities and bug reports database, but the news was never disclosed.
The former employees explained that Microsoft addressed all the vulnerabilities listed in the compromised database within months so that the vulnerabilities would have limited exploitation against Microsoft systems in the wild.
“Microsoft Corp’s secret internal database for tracking bugs in its own software was broken into by a highly sophisticated hacking group more than four years ago, according to five former employees, in only the second known breach of such a corporate database.” reported the Reuters.
You can imagine the importance of the archive for intelligence agencies and hackers, the database contained details of unfixed vulnerabilities in some of the most popular software and operating systems in the world.Spies for governments around the globe and other hackers covet such information because it shows them how to create tools for electronic break-ins.
The knowledge of such zero-day vulnerabilities would have been exploited in targeted attacks in the wild.
The employees attributed the attack to a “highly sophisticated hacking group,” likely they were referring a nation-state actor.
After the incident, Microsoft investigated every breach suffered by third-party companies in the following period to check if any of the vulnerabilities contained within the breached database were exploited in the attacks. The company declared that did not find any evidence of cyber attacks in the wild exploiting the information included in the hacked vulnerability database.
“Sometime after learning of the attack, Microsoft went back and looked at breaches of other organizations around then, the five ex-employees said. It found no evidence that the stolen information had been used in those breaches.” continued the Reuters.
The Reuters claims the threat actor behind the data breach is an APT group known Wild Neutron. (i.e. Morpho, Jripbot, Butterfly, ZeroWing, or Sphinx Moth). Wild Neutron is a financially motivated espionage group that targeted large enterprises, including Microsoft, Apple, Twitter, and Facebook.
According to the analysis published by Kaspersky Lab in 2015, the Morpho APT group is specialized in corporate espionage and has been active since at least 2011.
The researchers speculate that the group is responsible for the attacks in 2013 on the IT giants Apple, Facebook, Microsoft, and Twitter.
The above attacks were discovered in February 2013, a few weeks after, Microsoft admitted an attack, but it specified the attackers had limited access to its network.
“As reported by Facebook and Apple, Microsoft can confirm that we also recently experienced a similar security intrusion,” the company said on Feb. 22, 2013.
“We found a small number of computers, including some in our Mac business unit, that were infected by malicious software using techniques similar to those documented by other organizations. We have no evidence of customer data being affected, and our investigation is ongoing.”
Three of the five former employees declared that the vulnerability have been used in attacks in the wild.
“They absolutely discovered that bugs had been taken,” said one. “Whether or not those bugs were in use, I don’t think they did a very thorough job of discovering.”
The Morpho team exploited a Flash Player and Java zero-day in its attacks and digitally signed its malicious code by using stolen Acer Incorporated digital certificates.
The hackers exploited a Java zero-day, tracked as CVE-2013-0422, in the attacks against Twitter and Facebook. Hackers tricked Twitter and Facebook employees into visiting hacked forums hosting the Java zero-day exploit.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Microsoft, data breach)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/64403/data-breach/microsoft-vulnerabilities-db-hack.html