Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/15/2019
05:10 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Microsoft Downplays Scope of Email Attack

An unknown attacker used a support agent's credentials to access email content belonging to some Outlook, Hotmail users.

Microsoft on Monday maintained that an incident reported over the weekend about an unknown attacker using a customer support agent's credentials to access email content belonging to users of MSN, Outlook, and Hotmail accounts, affected only a limited number of users.

In initial comments on Saturday to TechCrunch—the first to report on the intrusion—Microsoft confirmed that email accounts belonging to just a few users had been compromised.

The company said the attackers had not accessed or viewed the actual content of the emails or any attachments. Instead, only certain other information related to a user's account such as the email address, subject lines, email folders, and email addresses of people the user has communicated with, had been viewed or accessed.

An email from Microsoft to one of the victims that was later posted Saturday to Reddit, described the unauthorized access as lasting from Jan. 1, 2019 and March 28, 2019. The letter warned the user to be wary about phishing attempts while noting that Microsoft had no idea why the intruders might have viewed the email information or how it might have been used. Microsoft immediately disabled the stolen credentials preventing further misuse the company said.

In later comments, including those made to Dark Reading today, Microsoft admitted that the intruders had actually accessed and viewed email content in some cases. The company did not provide any specifics on the number of users that might have had their email accounts compromised in this manner, however.

"Our notification to the majority of those impacted noted that bad actors would not have had unauthorized access to the content of e-mails or attachments," a Microsoft spokesperson said. However, with approximately 6% of the already "limited subset" of users overall that were impacted, the attackers had unauthorized access to email content as well.

"We addressed this scheme, which affected a limited subset of consumer accounts, by disabling the compromised credentials and blocking the perpetrators' access," the company said. Microsoft also has increased detection and monitoring of the impacted email accounts out of an abundance of caution.

Questions Remain

The relatively scant details from Microsoft about the intrusion is prompting questions about how attackers might have obtained the support agent's credentials, why the breach remained undetected for close to three months, how the company discovered it, and what the intruders might have been after.

Similarly, it's unclear if the support agent was specifically targeted because of the access that his or her credentials provided to customer email information.

"This breach, albeit seemingly fairly limited in scope, still follows a familiar pattern," said David Higgins, technical director at CyberArk. "Attackers compromised privileged credentials in order to gain greater access to wider customer data." The takeaway for enterprises is to pay more attention to administrator accounts and to accounts with privileged access to sensitive customer and business data.

Attacks involving the use of valid credentials can be very hard to detect, added Tim Erlin, vice president of product management and strategy at Tripwire. So it is important for organization to ensure and enforce separation of duties to mitigate the scope of attacks such as the one on Microsoft he said.

"While there’s a certain amount of schadenfreude in discussing the security failings of a company like Microsoft, these types of incidents should really force every organization to evaluate how they've implemented their own security controls," Erlin said.

News of the Microsoft email hack somewhat ironically enough came just days after news about Yahoo reaching a $117.5 million accord with victims of breaches at the company that ended up exposing email addresses, passwords, and other data of some 3 billion users.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/16/2019 | 10:21:51 AM
Odd combination
Nobody uses Hotmail anymore - like AOL it is old news.  I have an account and have not touched it in years. Outlook is different altogether, everybody in the world uses it as an email CLIENT for their primary account, either corp to an Exchange server or private such as gmail and others.  So the Outlook portion is dramatically wider, larger and far more dangerous.  Crack that and expose increases huge.  I would not include hotmail in the same article.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Exploiting Google Cloud Platform With Ease
Dark Reading Staff 8/6/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15138
PUBLISHED: 2020-08-07
Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the _Previewers_ plugin...
CVE-2020-9490
PUBLISHED: 2020-08-07
Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerab...
CVE-2020-11852
PUBLISHED: 2020-08-07
DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to July 2020. The vulnerability could allow a logged in user with rights to generate DKIM key information to inject system commands into the call to the DKIM syste...
CVE-2020-11984
PUBLISHED: 2020-08-07
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
CVE-2020-11985
PUBLISHED: 2020-08-07
IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively...