Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/15/2019
05:10 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Microsoft Downplays Scope of Email Attack

An unknown attacker used a support agent's credentials to access email content belonging to some Outlook, Hotmail users.

Microsoft on Monday maintained that an incident reported over the weekend about an unknown attacker using a customer support agent's credentials to access email content belonging to users of MSN, Outlook, and Hotmail accounts, affected only a limited number of users.

In initial comments on Saturday to TechCrunch—the first to report on the intrusion—Microsoft confirmed that email accounts belonging to just a few users had been compromised.

The company said the attackers had not accessed or viewed the actual content of the emails or any attachments. Instead, only certain other information related to a user's account such as the email address, subject lines, email folders, and email addresses of people the user has communicated with, had been viewed or accessed.

An email from Microsoft to one of the victims that was later posted Saturday to Reddit, described the unauthorized access as lasting from Jan. 1, 2019 and March 28, 2019. The letter warned the user to be wary about phishing attempts while noting that Microsoft had no idea why the intruders might have viewed the email information or how it might have been used. Microsoft immediately disabled the stolen credentials preventing further misuse the company said.

In later comments, including those made to Dark Reading today, Microsoft admitted that the intruders had actually accessed and viewed email content in some cases. The company did not provide any specifics on the number of users that might have had their email accounts compromised in this manner, however.

"Our notification to the majority of those impacted noted that bad actors would not have had unauthorized access to the content of e-mails or attachments," a Microsoft spokesperson said. However, with approximately 6% of the already "limited subset" of users overall that were impacted, the attackers had unauthorized access to email content as well.

"We addressed this scheme, which affected a limited subset of consumer accounts, by disabling the compromised credentials and blocking the perpetrators' access," the company said. Microsoft also has increased detection and monitoring of the impacted email accounts out of an abundance of caution.

Questions Remain

The relatively scant details from Microsoft about the intrusion is prompting questions about how attackers might have obtained the support agent's credentials, why the breach remained undetected for close to three months, how the company discovered it, and what the intruders might have been after.

Similarly, it's unclear if the support agent was specifically targeted because of the access that his or her credentials provided to customer email information.

"This breach, albeit seemingly fairly limited in scope, still follows a familiar pattern," said David Higgins, technical director at CyberArk. "Attackers compromised privileged credentials in order to gain greater access to wider customer data." The takeaway for enterprises is to pay more attention to administrator accounts and to accounts with privileged access to sensitive customer and business data.

Attacks involving the use of valid credentials can be very hard to detect, added Tim Erlin, vice president of product management and strategy at Tripwire. So it is important for organization to ensure and enforce separation of duties to mitigate the scope of attacks such as the one on Microsoft he said.

"While there’s a certain amount of schadenfreude in discussing the security failings of a company like Microsoft, these types of incidents should really force every organization to evaluate how they've implemented their own security controls," Erlin said.

News of the Microsoft email hack somewhat ironically enough came just days after news about Yahoo reaching a $117.5 million accord with victims of breaches at the company that ended up exposing email addresses, passwords, and other data of some 3 billion users.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/16/2019 | 10:21:51 AM
Odd combination
Nobody uses Hotmail anymore - like AOL it is old news.  I have an account and have not touched it in years. Outlook is different altogether, everybody in the world uses it as an email CLIENT for their primary account, either corp to an Exchange server or private such as gmail and others.  So the Outlook portion is dramatically wider, larger and far more dangerous.  Crack that and expose increases huge.  I would not include hotmail in the same article.
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9351
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. If an unauthenticated attacker makes a POST request to /tools/developerConsoleOperations.jsp or /isomorphic/IDACall with malformed XML data in the _transaction parameter, the server replies with a verbose error showing where the application resides (the a...
CVE-2020-9352
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. Unauthenticated exploitation of blind XXE can occur in the downloadWSDL feature by sending a POST request to /tools/developerConsoleOperations.jsp with a valid payload in the _transaction parameter.
CVE-2020-9353
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) loadFile provided by the console functionality on the /tools/developerConsoleOperations.jsp (or /isomorphic/IDACall) URL is affected by unauthenticated Local File Inclusion via directory-traversal sequences in the elem XML ...
CVE-2020-9354
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) saveFile provided by the console functionality on the /tools/developerConsoleOperations.jsp (or /isomorphic/IDACall) URL allows an unauthenticated attacker to overwrite files via vectors involving an XML comment and /.. pat...
CVE-2020-9355
PUBLISHED: 2020-02-23
danfruehauf NetworkManager-ssh before 1.2.11 allows privilege escalation because extra options are mishandled.