Week of January 9, 2023: Rackspace Breach Details Emerge, Microsoft Patches Zero-Day

Security leaders faced disclosure of the exploit chain behind Rackspace's Hosted Exchange ransomware breach and Microsoft's patch for an actively exploited Windows zero-day during the week of January 9, 2023. The week also brought new UK NCSC guidance on managed service provider risk, a healthcare industry council formed to tackle third-party cyber risk, and disclosure of unpatchable architectural flaws in widely deployed Siemens S7-1500 programmable logic controllers.

Rackspace Confirms Exchange Exploit Chain Behind Hosted Email Ransomware Breach

Rackspace confirmed that the Play ransomware group breached its Hosted Exchange email environment using an exploit chain combining CVE-2022-41082 and CVE-2022-41080, vulnerabilities in Microsoft Exchange Server. A forensic investigation found that attackers accessed Personal Storage Tables belonging to 27 Hosted Exchange customers, though no evidence emerged that data within those files was viewed, obtained, or misused. Rackspace said the Hosted Exchange service would not be rebuilt and pointed affected customers toward migration options including Microsoft 365 and its Rackspace Email service, while continuing efforts to recover remaining customer email archives. (Help Net Security)

CISA Adds Exchange and Windows ALPC Flaws to Known Exploited Vulnerabilities Catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog on January 10, 2023, based on evidence of active exploitation: CVE-2022-41080, a Microsoft Exchange Server privilege-escalation flaw, and CVE-2023-21674, a Windows Advanced Local Procedure Call vulnerability patched during that month's Patch Tuesday. Binding Operational Directive 22-01 requires federal civilian agencies to remediate catalog entries by set deadlines, and CISA urged all organizations to prioritize the vulnerabilities as part of routine patch management given documented in-the-wild exploitation. (CISA)

Microsoft's January Patch Tuesday Fixes Actively Exploited Windows Zero-Day

Microsoft's January 2023 Patch Tuesday addressed 98 CVE-numbered vulnerabilities, including CVE-2023-21674, an actively exploited flaw in Windows Advanced Local Procedure Call that could let an attacker escape a browser sandbox and gain SYSTEM privileges. The update also fixed a publicly disclosed Windows SMB Witness bug, CVE-2023-21549, and a critical SharePoint Server security-feature-bypass flaw, CVE-2023-21743, that could let an unauthenticated remote attacker make an anonymous connection to an affected server. The release coincided with Microsoft ending extended security support for Windows 7 and Windows 8.1 on the same day. (Help Net Security)

NCSC-UK Issues Guidance on Using Managed Service Providers for Cloud Administration

The UK's National Cyber Security Centre published guidance on January 11, 2023, addressing the security trade-offs of using managed service providers to administer cloud environments. The post outlined specific checks organizations should perform to confirm an MSP's ability to defend against cyber threats before granting administrative access to cloud infrastructure. CISA highlighted the guidance and encouraged organizations that rely on MSPs for cloud administration to apply the recommendations, reflecting continued regulatory attention on third-party access as a growing source of enterprise risk. (CISA)

Healthcare CISOs Form Health3PT Council to Tackle Third-Party Cyber Risk

More than 20 healthcare organizations launched the Health3PT Council on January 11, 2023, bringing together security and risk executives from systems including Highmark Health, HCA Healthcare, CVS, Humana, and UPMC to address third-party cyber risk across the sector. The initiative cited a survey finding that 55% of healthcare organizations suffered a third-party breach in the prior year and Gartner data showing only 23% of security and risk leaders monitor third parties in real time. The council planned to publish benchmarking research on third-party risk metrics during the first quarter of 2023. (Help Net Security)

Researchers Disclose Unpatchable Root-of-Trust Flaw in Siemens S7-1500 PLCs

Red Balloon Security disclosed architectural vulnerabilities, tracked as CVE-2022-38773, in Siemens SIMATIC and SIPLUS S7-1500 series programmable logic controllers that allow bypass of protected boot features across more than 120 CPU models. Siemens confirmed the findings, which stem from a flawed hardware root-of-trust implementation using a secure cryptographic processor that cannot be fixed through firmware updates. Exploitation requires physical access but researchers warned the flaws could be chained with remote vulnerabilities to install malicious firmware without in-person contact, prompting Siemens to recommend restricting physical access to the affected industrial controllers. (Help Net Security)

DataGrail Names Chris Deibler VP of Security

DataGrail named Chris Deibler, formerly of Shopify, Twitch, and Box, as its VP of Security on January 10, 2023, tasking him with building out the company's security team as it scales. Deibler previously served as Director of Security Engineering at Shopify, where he ran a multimillion-dollar bug bounty program, and earlier built Twitch's security organization from its first full-time hire to roughly 40 employees. The appointment reunited him with DataGrail CTO Cathy Polinsky, with whom he had worked previously at Shopify. (Help Net Security)