At least 10 hacking groups using Microsoft software flaw -researchers
USA-CYBER/MICROSOFT (PIX):At least 10 hacking groups using Microsoft software flaw -researchers
news.trust.org
Gigantic Microsoft Hack
- Thread starter SubLGT
- Start date
news.trust.org
Isnt that about 50% of the worlds servers?
Heavens no. First off, Microsoft email servers wouldn't have nearly, nearly a 50% market share (under 3% according to this metric - http://www.securityspace.com/s_survey/data/man.201504/mxsurvey.html) and the slice of that slice of the pie that represents on-premises servers would be very low, and lowering rapidly: You have to have an extremely compelling use case for on-premises email hosting and/ or a special affinity for being miserable.
Last edited:
OVERKILL
$100 Site Donor 2021
Exactly. We moved away from on-premises about 6 years ago to Office 365, which, as noted, is not impacted by this.
The problem with on-premises servers is that they are very often operated by businesses on a budget nowadays which means they aren't kept up-to-date and IT resources are limited. This can be small school boards, small healthcare organizations...etc. Those least equipped to deal with a situation like this.
I expect this may trigger an exodus, admittedly small, given the scope, of these types of clients to alternatives. Not much of a loss for Microsoft really, they've been pushing Office 365 for many years.
Some qmail-heads have accepted the fact that managing an email server is way more painful than sitting back and letting MS do the heavy lifting.
I run a Exchange-Hybrid shop with one On-Prem server that syncs to Office 365.
I keep my server up on the CU releases, so doing this was a simple patch for us.
There are a lot of organizations who are behind on CU's, and .net Framework releases, so they were in a world of pain.
Took about 20 minutes to patch and reboot.
I keep my server up on the CU releases, so doing this was a simple patch for us.
There are a lot of organizations who are behind on CU's, and .net Framework releases, so they were in a world of pain.
Took about 20 minutes to patch and reboot.
You applied the new CU, the patch, and scanned for the web shells in 20 minutes???
I thought we were talking about Microsoft mail servers only
Already had the CU in place it was released the month before.
That is correct.
OVERKILL
$100 Site Donor 2021
Ahhh, that sucks. I made the decision to migrate to 365 because when I costed it, as we were due for a hardware refresh, it just made sense at the time. On top of that, in terms of convenience for managing it for me, and the ability to manage other tenants through the Partner Portal, I figured it was something I could encourage smaller clinics to pick-up, which has been a successful endeavour.
Other nice thing of course is that nothing is forwarded through the firewall.
I’ve heard banks and other financial firms are still using on-prem Exchange servers - SOX or other reasons?
work has been using M365 for a while. Except for phishing that happens due to users not being vigilant, it works fine.
work has been using M365 for a while. Except for phishing that happens due to users not being vigilant, it works fine.
OVERKILL
$100 Site Donor 2021
I found MFA, while definitely not perfect, has greatly reduced, dare I say mostly eliminated, users from getting their accounts compromised, for e-mail at least. You of course still have to change their password after they fall for it, but at least the perp doesn't gain access to the account.
Of course internal systems can be breached via means that are well outside the scope of user auth, but as far as on that front, MFA is a huge help.
Yesterday, someone at work got phished - M365 ATP alerted us to weird activity from Nigeria. A user allowed a login via MFA even though he never initiated the login. MFA isn’t perfect but with some education it prevents phishing attacks from being successful.
OVERKILL
$100 Site Donor 2021
ewww, let me guess, they are using the Authenticator app which just prompts for permission? I have all my users on text verification, so the phisher would actually need the code sent via SMS to get in. SMS isn't perfect, but I think it's better than the app in that sort of scenario.
The user was setup for a phone call. I have my non-admin account using Authenticator. My personal Google account is using a Titan hardware key.
OVERKILL
$100 Site Donor 2021
When I was evaluating all the options I thought to myself "which way is the least likely for the user to screw up?" and I figured them having to manually enter a code was the least likely to get exploited, so I went that way across the board for them, but of course it's the biggest PITA for end users. Of course that may not be an option for every organization. I know Microsoft REALLY pushes the authenticator app, but the assumption that if you have access to the device with the app and can just hit "approve" on the screen without having to enter a code is deeply flawed, because some users will just approve it, similar to your phone situation.
Similar threads
