Protection from HAFNIUM

I think because there is no "promotion" on Sophos side it's not safe/secure at the moment. I think just OWA will be safe if you use WAF together with Reverse Authentication.

I checked also other vendors, just checkpoint have some infos at the moment:

https://blog.checkpoint.com/2021/03/04/attacks-targeting-microsoft-exchange-check-point-customers-remain-protected/

Good Morning Sophos....Sorry but customers expect quick informations in case of such big exploits from a "IT Security" Company...

But nothing on https://nakedsecurity.sophos.com/ or https://twitter.com/sophossupport

I think because there is no "promotion" on Sophos side it's not safe/secure at the moment. I think just OWA will be safe if you use WAF together with Reverse Authentication.

I checked also other vendors, just checkpoint have some infos at the moment:

https://blog.checkpoint.com/2021/03/04/attacks-targeting-microsoft-exchange-check-point-customers-remain-protected/

Good Morning Sophos....Sorry but customers expect quick informations in case of such big exploits from a "IT Security" Company...

But nothing on https://nakedsecurity.sophos.com/ or https://twitter.com/sophossupport

Thank you for your answer. That's why I put it on the spot, at least a part of my motivation. It's important for a security product to perform in such cases. I think we all pay for that, so we deserve at least information. At the moment, marketing consists more of colorful images that suggest it's a great product instead of hard facts.

Your Assumption "no promotion = no protection" is wrong.

I hope so :-)

But a small, contemporary notification from Sophos (somewhere: twitter, nakedsecurity...) that just tells "pattern are Up2date now" in case of such big exploits would be great...

I also asked in Support-Chat today and the guy told me to ask my territory manager instead of direct linking to IPS-List...

Hi Steve,

again: if you rely on AV or IPS or WAF alone you are doing it wrong!

• HOST AV/ML/C2 detections can assist you finding known post-exploitation artefacts (webshells...)
• GW IPS/ATP detections can visualize ongoing exploitation or exfiltration attempts (lateral movement)
• EDR/XDR can help you find further evidence or assist your inverstigation/forensics

btw. why are we even still in the Web Protection Forum?

My Sophos Contact just dropped me the following

Webshell related: Troj/WebShel-L/M/N, Troj/ASPDoor-T, Troj/AspScChk-A

Other payloads: ATK/Pivot-B, AMSI/PowerCat-A, AMSI/PSRev-A, C2/ATP and CIXA CredGuard

I personally have seen ATK/Pivot-B and Troj/AspScChk-A at compromised customers sites so far

www.virustotal.com/.../detection (26/59 at 2021-03-06)

www.virustotal.com/.../detection (20/61 at 2021-03-06)

Regards

Steven