Generic filters

Episode 252 – Microsoft Exchange Hack and advice for Threat Hunting – MySecTV Takeaway

Following Microsoft’s news about Hafnium, the Australian Cyber Security Centre (ACSC) advises organisations using Microsoft Exchange to urgently patch the following Common Vulnerabilities and Exposures (CVEs):

CVE-2021-26855 – server-side request forgery (SSRF) vulnerability in Exchange.
CVE-2021-26857 – insecure deserialization vulnerability in the Unified Messaging service.
CVE-2021-26858 – post-authentication arbitrary file write vulnerability in Exchange.
CVE-2021-27065 – post-authentication arbitrary file write vulnerability in Exchange.
If successfully exploited, these CVEs would allow an unauthenticated attacker to write files and execute code with elevated privileges on the underlying Microsoft Windows operating system.

A large number of Australian organisations are yet to patch vulnerable versions of Microsoft Exchange, leaving them vulnerable to compromise. The ACSC is encouraging these organisations to do so urgently.

We cross to the US and speak with Mat Gangwer, Senior Director, Sophos Managed Threat Response and review the Microsoft Exchange hack and threat hunting advice.

Full article, including updated ESET research:

#Exchangehack​ #microsoft​ #cybersecurity​ #cyberbreach​ #exchange​ #CVE​ #Sophos

Recorded Friday 12 March 2020 – video version is available here


About the Provider

MySecurity Media
MySecurity Media has an all-media capability and continues to track the rapid advancement of security and technology to educate, entertain and engage with professionals around the world and across the security domain.