Hacker News Reader

Comment by exporectomy | Hacker News Reader

I can't tell from the article, but was this vulnerability already being exploited but to a lesser extent or did the hackers apparently discover it as a result of the patch being released? If the latter, then maybe we need processes for patching faster than people can reverse engineer the patches.

View on HN

Yes, it was being used to target specific organizations prior to Microsoft's patches this week. Since then, attackers have basically used tools like Shodan to find unpatched servers, and mass-backdoored them -- regardless of who the victim organization is.

Do you have any details you can share with us (support@shodan.io) about how attackers are using Shodan? We have a lot of mechanisms to prevent abuse (blocking anonymous access, limiting number of results/ searches, restricting certain search filters) and if there's more we can do please let me know.

Btw Microsoft, CERTs and a bunch of other orgs are also using Shodan to find out who is exposed. We already had all the data to determine vulnerability before the announcement was made so enterprise customers could search their local Shodan database for affected systems. And we've been sending out notifications as well.

I don't think that's an accusation against you, but I have to imagine there's a Shodan inspired darkweb site somewhere that takes crypto in exchange for bypassing all those noble restrictions.

Keep it real, Shodan-bro. Thanks for the additional context.

Lovin' my membership.

Bigger companies or at least ones with significant relationships with Microsoft often get NDA-covered security bulletins before they are publicly released to help mitigate this.

Interesting! This seems futile at times, especially with the SolarWinds espionage that went undetected for so long.

The question that comes to mind is: to what extent did Threat Actors have unfettered access to security bulletins?

There is no easy solution to the issue. Thank you for bringing this up.

Really? I thought the article was quite clear.

> On March 2, Microsoft released emergency security updates to plug four security holes in Exchange Server ...

> ... [Volexity] first saw attackers quietly exploiting the Exchange bugs on Jan. 6, 2021, ...

If it still wasn't apparent by then, though, I would have thought that this line should've cleared things up:

> We’ve worked on dozens of cases so far where web shells were put on the victim system back on Feb. 28 [before Microsoft announced its patches], ...*

Reply on news.ycombinator.com