UK electoral body breached through Microsoft Exchange Server: claim

Friday, 11 August 2023 06:46

UK electoral body breached through Microsoft Exchange Server: claim Featured

By Sam Varghese

British security expert Kevin Beaumont. Supplied

An unpatched vulnerability in Microsoft Exchange Server appears to have been the entry point for the attackers who breached the systems of the UK Electoral Commission, a fact disclosed by the agency on Wednesday 10 months after it was spotted.

Well-known British security researcher Kevin Beaumont said in a blog post on Thursday that the Electoral Commission was running the software on IP 67.98.206.41 and it was online until later in 2022, with Outlook Web App being exposed to the Internet.. The incident came to the agency's notice in October of that year.

Using Shodan.io, a search engine that can be used to look for various types of servers connected to the Internet, Beaumont showed [graphic below] that the server was still online in September 2022, and later stopped responding.

In its Wednesday statement, the UK Electoral Commission, an independent body which oversees elections and regulates political finance in the UK, said the attackers appeared to have first gained access to its systems in August 2021.

Beaumont said the version number of Exchange Server was visible – it was 15.1.2507.12. "This corresponds to Exchange Server 2016, last security updated in August 2022." he wrote [second graphic below].

He said the Electoral Commission or its IT supplier was doing the right thing. "They were applying security patches quickly during this time in 2022. [But] 2021 data isn’t available, so it is unknown how well they were patching prior during the ProxyShell and ProxyLogon Microsoft Exchange vulnerabilities."

In late September that year, a vulnerability chain, named as ProxyNotShell by Beaumont in October 2022, became public knowledge. when he tweeted out details of the issue.

Beaumont recalled that Microsoft had issued temporary mitigations for ProxyNotShell and took until November 2022 to fix the two bugs in question.

"The Electoral Commission was running Exchange Server in this configuration during the main incident timeline," he said.

"They were vulnerable to ProxyNotShell attacks. ProxyNotShell allows remote code execution on their Exchange email server, or in other words complete compromise of their network (Exchange Server runs with highly privileged Active Directory accounts by default)."

Contacted for comment, an UK Electoral Commission spokesperson said: "We’re not able to comment. The Commission is under investigation by the Information Commissioners Office, and cannot release any information that could compromise their investigation."

Microsoft was also contacted for comment, but a company spokesperson said it had nothing further to share.

Read 183 times

Please join our community here and become a VIP.

Subscribe to ITWIRE UPDATE Newsletter here
JOIN our iTWireTV our YouTube Community here
BACK TO LATEST NEWS here

GARTNER MARKET GUIDE FOR NDR 2022

You probably know that we are big believers in Network Detection and Response (NDR).

Did you realise that Gartner also recommends that security teams prioritise NDR solutions to enhance their detection and response?

Picking the right NDR for your team and process can sometimes be the biggest challenge.

If you want to try out a Network Detection and Response tool, why not start with the best?

Vectra Network Detection and Response is the industry's most advanced AI-driven attack defence for identifying and stopping malicious tactics in your network without noise or the need for decryption.

Download the 2022 Gartner Market Guide for Network Detection and Response (NDR) for recommendations on how Network Detection and Response solutions can expand deeper into existing on-premises networks, and new cloud environments.

DOWNLOAD NOW!

PROMOTE YOUR WEBINAR ON ITWIRE

It's all about Webinars.

Marketing budgets are now focused on Webinars combined with Lead Generation.

If you wish to promote a Webinar we recommend at least a 3 to 4 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site itwire.com and prominent Newsletter promotion https://itwire.com/itwire-update.html and Promotional News & Editorial. Plus a video interview of the key speaker on iTWire TV https://www.youtube.com/c/iTWireTV/videos which will be used in Promotional Posts on the iTWire Home Page.

Now we are coming out of Lockdown iTWire will be focussed to assisting with your webinars and campaigns and assistance via part payments and extended terms, a Webinar Business Booster Pack and other supportive programs. We can also create your adverts and written content plus coordinate your video interview.

We look forward to discussing your campaign goals with you. Please click the button below.

MORE INFO HERE!