Another sophisticated and widespread cyber attack just made the news last week. This attack, dubbed ProxyLogon, strings together four zero-day vulnerabilities in Microsoft Exchange Server that allow attackers to take over servers, compromise email and implant a web shell that gives them the ability to execute code on the servers from anywhere without authentication. Microsoft immediately released emergency patches for the identified vulnerabilities, tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
These attacks, initially attributed to the China-backed group Hafnium, were first noticed in early January and reported to Microsoft on March 2. It has since been determined that multiple advanced persistent threat groups have also been using this same exploit since about the same time of the Microsoft patch release (March 2), and that hundreds of thousands of servers around the world have already been attacked.
News of the attack caused immediate panic on multiple levels of government and industry. The CISA recommended immediately patching these issues or unplugging Exchange servers until they are patched. They also recommended that all possibly affected organizations should immediately take steps to determine if their systems have already been compromised. The word everyone is using here is “immediate.”
This Exchange Server attack surely does remind me of the way the devastating supply chain attacks we are still dealing with. Here we have highly enabled, state backed hacking groups systematically identifying cyber-vulnerabilities of every type, developing a group of exploits designed to take advantage of these vulnerabilities, identifying lots of fat targets to hit and then striking all of those targets at once. That is evidently the same thing that is happening with the Exchange Server attacks. And curiously, both these attacks and the supply chain attacks exploited flaws that had been present in the code for ten years or more. What’s more, if these Exchange Server attacks follow the same program, we can expect follow up exploits to be waiting in the eaves to further exploit the vulnerabilities and the panic they fomented.
What this tells me is that we are presently in the first stages of a global cyberwar whether we recognize it or not. So far, we are just taking the hit and scrambling around playing catch up while we try to figure out how to effectively address the problem. However, the enemy does not seem to be giving us time to sort things out. What would you like to bet that another, similarly devastating attack will hit us in no more than six months from now? I would put a nice chunk of change on that bet!
Another thing that these attacks show me is that we have gotten distributed network security wrong from the very beginning. The basic code that still lies at the very core of the Internet was never designed with security in mind and is basically flawed. We adopted it anyway and by the time security problems started to manifest themselves, it was too late; the paradigm was set. Going back and revamping it will prove to be impossible. You might as well try to get Americans to drive on the left side of the road, say “ahoy” instead of “hello” when answering the telephone and to use Metric measurements rather than Standard.
So how are we going to keep our riches and information safe from the Cyber Scourge? I certainly don’t have an answer that has any chance of actually being implemented. However, I would venture to guess that whatever solutions appear in the near future, they will probably be Draconian! Time for everyone to plan on expending a bigger chunk of their resources on cyber-security.