Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Protect assets from ransomware, trojans, rootkits and more.
Intelligence and visibility across AWS, O365, DevOps and more.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
A new attack technique has been identified by security researcher Dirk-jan Mollema, which could allow an attacker to impersonate other Exchange users and elevate privileges .
Microsoft has released updated guidance on this issue which includes security updates to Exchange .
Proof-of-concept (PoC) code is available and is simple to use . Customers are advised to test and deploy available security updates as soon as possible.
Assess and deploy relevant Security Updates from Microsoft (released on February 12, 2019) .
Microsoft’s previously suggested workarounds negatively impacted EWS clients such as Outlook for Mac or Skype for Business. Microsoft has stated the following regarding potential impact with the latest security updates:
“We have evaluated the changes to push notifications against many commonly used EWS clients, e.g. Outlook Mac, Skype for Business Client, native iOS mail clients and observed no loss of functionality due to these changes” .
If applying the security updates is not currently a viable option, Microsoft’s alternative mitigation via Throttling Policy can also be implemented, but potential impacts should be understood.
The attack is conducted by using the Exchange Web Services' PushSubscription service to subscribe for push events, pointing them to the attacker’s machine. Exchange will connect to the attacker’s machine using the PushSubscriptionRequest method where it will attempt to authenticate using NTLM credentials (for the computer account of the Exchange server). These credentials are then relayed to a Domain Controller where the Exchange account can be used to elevate privileges for an account under the attacker’s control.
Unpatched Exchange 2013, 2016 and 2019 have been confirmed as vulnerable to this attack.