Zimbra 0-day used to steal email data from government organizations | Hacker News Reader

Zimbra 0-day used to steal email data from government organizations

blog.google

133 pointshasheddan28 comments

This is a timely reminder to anyone still using Zimbra 8.x.x that is reaches EOL at the end of next month. There is no official open release of later versions despite much being covered by open source licenses. If you have not already moved off Zimbra you need to, ASAP, do one of the following:

1. Pay for Zimbra and upgrade that way.

2. Try compile up a later version yourself…

3. Migrate to one of the forks that sprang up (most of them are dead though, Zextras/Carbonio is still going but last time I looked the system requirements were a bit daft for what little functionality I actually need)

4. Migrate to something else entirely.

Not sure what you are talking about. To me it looks like you can just DL and install 9.0 or 10.0 community release. Am I missing something?

https://www.zimbra.com/product/download/zimbra-collaboration...

Looking at the links on that page, the only links for 9.0 or 10.0 look to be for the network edition (non oss)

I'm not familiar with the situation, but reading through https://blog.zimbra.com/2020/05/is-zimbra-open-source-yes-fa... suggests that they do still provide source for at least some portions of 9.x, but they no longer provide binaries or packages.

It looks like some components may be missing ("Modern UI"), but I don't know if it's usable without them.

9.0 onwards never has a “community edition” release so people self-hosting that rather than paying for licensing for “network edition” have stuck at 8.x. Note that there are two downloads for 8.8.15 on the linked page, one of which is marked “open source”. Anyone who is still there has been getting security updates, but that stops being the case once 8.8.15 hits EOL.

I'm one of those who needs to upgrade and the pre sales part is hell.

Either your not big enough to get any priority. They never reply. Or the costs are just too stupid for a personal account with 5-10 mailboxes.

I host on-prem too, via colocation which then increases the cost ten-fold. It's as these companies don't want customers.

Liked the look to IceWarp suite and yet they've been non-existence in sales that I end up expecting though out.

https://proton.me/mail Has improved a lot if you can tolerate third party hosted (but still privacy centric solutions).

Ive been using the free Axigen version for years, pretty good, no shenanigans

Thank you. I'm really looking forward to trying their suite out.

Ticks all the right boxes.

My needs have changed a lot over the years. I no longer run company email for DayJob¹, and for the server I ran for myself, family & friends, I've jammed together a mail server³ from standard parts.

I still have Zimbra running behind a firewall (those who need access do so via SSH tunnel) for archive access, in case anything didn't transfer cleanly to the new arrangement and for things I didn't bother transferring.

----

[1] since we've grown we have infrastructure/support people who look after that instead of muggins here doing everything, and we've long since² moved over to O365

[2] at least one buy-out ago

[3] the number of actual users⁴ is down to me and three others, and we barely used features beyond mail in the end

[4] more accounts used by those human users

At that scale, Synology NAS running MailPlus can be very cost-effective. Comes with five mailboxes. Buy two, activate MailPlus High Availablity — which also pools the mailbox licenses, and you're set for 10 mailboxes over the +/- 8 years they'll actively support the device. With the rest of their software suite it can tick all the boxes tho the lack of a MAPI/EAS implementation is a miss.

I've heard good things about mailcow

https://mailcow.email/

Where's the OpenZim Foundation when you need it?

It feels like they waited a long time to post an advisory for an exploit that was being actively used by threat actors, more than a week after they pushed a fix to their repositories. Why not give customers a heads up prior? At least give your users a fighting chance.

> The patch for the vulnerability was pushed to Github on July 5. Another actor exploited the vulnerability for a full two weeks beginning on July 11 before the official patch became available on July 25.

What's the point of a responsible disclosure embargo policy when the enterprise software developer alerts threat actors of the precise vuln three full weeks before they even begin to patch their customers' systems?

Oh, XSS. It’s the gift that keeps giving.

At some point I’m hoping AI can help with hardening by coming up with potentially novel security holes.

Right? Let's see some Hex Color Injection or Retina Inversion or Bytecode Reversal attacks. I want to see a flatline riding a black chrome shark into my browser. Enough of this "XSS" this and "Server-Side Request Forgery" that stuff.

As much as I got downvoted, the botnets that attack servers are going to greatly evolve.

And it’s not personal.

I was surprised that you were. What you're describing is inevitable.

Can’t please everyone

Is there very much a usecase for using AI to Xray a site and find all this bullshit in an automated fashion? The opposite seems so unreliable and unfashionable...

I would start with asking the cybersecurityists

[stub for offtopicness]

Post deleted, archive.org has it https://web.archive.org/web/20231116160518/https://blog.goog...

Nah. It's live. Their CDN had a hiccup.

Odd, looks like it was deleted? It's on archive.org though.

https://web.archive.org/web/20231116160518/https://blog.goog...

EDIT: updated URL here: https://blog.google/threat-analysis-group/zimbra-0-day-used-...

I think the URL just changed to

https://blog.google/threat-analysis-group/zimbra-0-day-used-...

Fixed now. Submitted URL was https://blog.google/threat-analysis-group/zimbra-0-day-used-.... Thanks!

Reply on news.ycombinator.com