Numerous IT administrators around the world had to change their agendas at short notice or work overtime at the beginning of March. All Exchange servers had to be updated to close a critical security gap. Even the American TV channel CNN reported on it. But what had actually happened?
Critical vulnerabilities were already exploited by hackers
Microsoft discovered several targeted zero-day attacks on on-premises versions of Microsoft Exchange Server. Cloud versions of Microsoft's email service were not affected. According to Heise, "over a hundred thousand Exchange servers worldwide have already been compromised. And more are being found every hour." The vulnerabilities can lead to remote code execution (RCE) and are therefore particularly critical. A hacker can send malicious cookies such as "X-AnonResource-Backend" and " X-BEResource" to the server to trigger the attack. The hacker group HAFNIUM, which is said to have connections with China, seems to be behind the large-scale attacks. Those who want to check whether they have already been attacked can find more information on the Microsoft Security Blog.
Airlock: Secure by Default
The sensational incident shows how valuable web application firewalls like Airlock Gateway can be. A WAF with a secure by default setting can buy administrators valuable time because it makes exploiting vulnerabilities much less likely. This is especially true for unknown vulnerabilities. A combination of WAF functions ensures that the attack surface is significantly reduced.
For popular applications such as Microsoft Exchange, standard WAF templates facilitate effective protection. Airlock Gateway offers such templates for Exchange and SharePoint, among others. Cookie protection is enabled both in these templates and in Airlock Gateway's standard security policy. This protects the application from manipulated cookies, such as those used in the "ProxyLogon" attack scenario.
How Cookie Protection works
The cookies of the application are stored in the web application firewall in a cookie store (per user) and never reach the browser by default. This Cookie Protection shields the users of a web application from unauthorized access to cookie content. And it also protects the server from modification of cookie content. Therefore, an attacker cannot manipulate cookies or send unknown cookies to the backend. The HAFNIUM hack revealed several vulnerabilities, one of which is exploited using cookie injection. Airlock Gateway prevents this type of attack with the Cookie Store.
Conclusion
Anyone who protects their Microsoft Mail Server with Airlock Gateway can sleep much more soundly. The prerequisite, of course, is that the WAF is configured securely — preferably by default. The Exchange patches urgently recommended by Microsoft are thus still necessary, but no longer quite so urgent.
![[Translate to Englisch:] Tablet](/fileadmin/_processed_/f/3/csm_EGN_Airlock-Blog_2880_Newsletter_01_9738ee447c.webp)
Blognews directly to your inbox
The Airlock Newsletter informs you continuously about new blog articles.