Protection from HAFNIUM

I think because there is no "promotion" on Sophos side it's not safe/secure at the moment. I think just OWA will be safe if you use WAF together with Reverse Authentication.

I checked also other vendors, just checkpoint have some infos at the moment:

https://blog.checkpoint.com/2021/03/04/attacks-targeting-microsoft-exchange-check-point-customers-remain-protected/

Good Morning Sophos....Sorry but customers expect quick informations in case of such big exploits from a "IT Security" Company...

But nothing on https://nakedsecurity.sophos.com/ or https://twitter.com/sophossupport

Thank you for your answer. That's why I put it on the spot, at least a part of my motivation. It's important for a security product to perform in such cases. I think we all pay for that, so we deserve at least information. At the moment, marketing consists more of colorful images that suggest it's a great product instead of hard facts.

See IPS pattern:

https://lists.astaro.com/ASGV9-IPS-rules.html#221

https://docs.sophos.com/releasenotes/index.html

Recommended mitigation as always: Patch Systems and look for IoCs (EDR). 

Hi Alexander,

IOC search should be performed mainly on the Exchange Server and not (only) on the Gateway (EDR and XDR (EAP) can help you achieve this goal faster).

If you allowed direct incoming HTTPS to Exchange (you did wrong;) neither pre-patch IPS nor WAF (MFA maybe;) saved you. Post-patch IPS is for visibility

Mitigate Microsoft Exchange Server Vulnerabilities | CISA

WAF Signatures are not a recommended mitigation though:

Christian Folini on Twitter: "People keep asking me for #ModSecurity rules to protect against the #HAFNIUM attacks / #CVE. But the attacks are very complex and the info I (we?) have is not comprehensive. I would rather have people patch their #Exchange than putting an incomplete set of #WAF rules in front." / Twitter

Regards Steven

Your Assumption "no promotion = no protection" is wrong.

I hope so :-)

But a small, contemporary notification from Sophos (somewhere: twitter, nakedsecurity...) that just tells "pattern are Up2date now" in case of such big exploits would be great...

I also asked in Support-Chat today and the guy told me to ask my territory manager instead of direct linking to IPS-List...

Hi Steve,

again: if you rely on AV or IPS or WAF alone you are doing it wrong!

• HOST AV/ML/C2 detections can assist you finding known post-exploitation artefacts (webshells...)
• GW IPS/ATP detections can visualize ongoing exploitation or exfiltration attempts (lateral movement)
• EDR/XDR can help you find further evidence or assist your inverstigation/forensics

btw. why are we even still in the Web Protection Forum?

My Sophos Contact just dropped me the following

Webshell related: Troj/WebShel-L/M/N, Troj/ASPDoor-T, Troj/AspScChk-A

Other payloads: ATK/Pivot-B, AMSI/PowerCat-A, AMSI/PSRev-A, C2/ATP and CIXA CredGuard

I personally have seen ATK/Pivot-B and Troj/AspScChk-A at compromised customers sites so far

www.virustotal.com/.../detection (26/59 at 2021-03-06)

www.virustotal.com/.../detection (20/61 at 2021-03-06)

Regards

Steven

https://news.sophos.com/en-us/2021/03/05/hafnium-advice-about-the-new-nation-state-attack/

Saerching for IOCs ist just the beginning...since every attacker is jumping on the "opportunistic adversary train" now!

HAFNIUM targeting Exchange Servers with 0-day exploits - Live Discover & Response Query Forum - Intercept X Endpoint - Sophos Community

I think every group and actor are trying to plant their backdoors asap or just seamless upgrade to spread and execute.