Connect with us

Press Release

Microsoft rushes to register credentials-leaking Autodiscover domains.

Published

on

Microsoft rushes to register credentials-leaking Autodiscover domains.

Microsoft is hurrying to register Internet domains that are used to intercept Windows credentials transmitted via subpar Microsoft Exchange Autodiscover deployments.

Amit Serper of Guardicore published further research on Monday describing how the problem resulted in the exposing of almost 100,000 different Windows and email credentials.

The app will attempt to authenticate to numerous Autodiscover URLs connected to Microsoft Exchange servers for their company when users configure their Exchange accounts on email clients. The Exchange server will send back the settings that the mail client should use if authentication is successful. Although many mail clients wrongly implement the Autodiscover protocol, causing them to attempt to authenticate to third-party autodiscover, including some variations of Microsoft Outlook and Office 365. [tld] URLs that have nothing to do with a user’s company.

Autodiscover.com, Autodiscover.uk, and Autodiscover.de are a few examples of such domains.

Threat actors might register autodiscover.[tld] domains and start gathering the stolen Windows and email login information in preparation for assaults on the company.

Microsoft rushes to register domains for autodiscovery
Microsoft has been aware of the problem for years. Research regarding incorrect Microsoft Autodiscover protocol implementations exposing Windows passwords is not new.

A formal research paper describing the leaks and the findings were both initially presented at Black Hat Asia 2017 briefing. Other researchers claimed that when they previously reported the problem to Microsoft, they were informed that it wasn’t a bug.

But after Serper published his findings, Microsoft told BleepingComputer that they were unaware of the material.

Additionally, BleepingComputer is aware of 38 additional domain names that have been registered since September 22nd but whose owners are obscured by privacy or WHOIS limitations. These names were probably registered by Microsoft, researchers, or prospective threat actors.

Since Microsoft registered numerous autodiscover domains for the same TLD, such as autodiscover.com.es and autodiscover.org.es, BleepingComputer believes the true number of registered domains is significantly higher.

It is unclear who the owner is of one domain, autodiscover.ch, which has been registered since at least 2015 and utilises microsoftonline.com as its DNS servers.

Microsoft will need to release solutions for the subpar Autodiscover implementation in their Microsoft Outlook and Office 365 mail clients to resolve the issue further, even though registering autodiscover.[tld] domains will stop some of the leaks.

Microsoft will also need to provide instructions on how to properly design Autodiscover URLs so that credentials are not transferred to dubious domains, as other non-Microsoft applications also have flawed protocol implementations.

 

Continue Reading

Press Release

Review of Bleeping Computer

Published

on

Review of Bleeping Computer

ComboFix is a tool made by sUBs that checks your computer for known malware and tries to automatically remove infestations when it finds any. In addition to being able to get rid of a lot of the most popular and up-to-date malware, ComboFix also shows a report that skilled assistants may use to get rid of malware that isn’t already eradicated by the programme.

Please be aware that executing this programme without supervision may result in improper operation of your computer. Run this programme only at the direction of a knowledgeable assistant.

At the moment, Windows 8.1 is not compatible with this programme, just Windows 8!

The author is collecting PayPal donations from people who want to support his work. By selecting the following picture, you may contribute:

Continue Reading

Press Release

Microsoft provides a fix for persistent Outlook login issues.

Published

on

Microsoft provides a fix for persistent Outlook login issues.

Microsoft is attempting to resolve ongoing sign-in issues that are preventing certain users of Outlook for Microsoft 365 from accessing their accounts.

Users who attempt to enter into Outlook using their Outlook.com accounts or those who have already added the accounts to their Outlook profiles are affected by the login issues.

The users will get the following error messages instructing them to use a work or school account rather than signing in: “You are unable to log in using a personal account here. Use your account from work or school instead.”

Although Microsoft claims that the Outlook Team is working on a patch for this known problem, users can access their accounts using an official workaround until a fix is released.

“You can get around the problem by disabling Support Diagnostics, which disables the ability to contact support through the In App Help menu by choosing Contact Support. The fault is connected to how Outlook is authenticating for the diagnostics in some cases, “explained Microsoft.

You must enable the DisableSupportDiagnostics policy setting in Outlook to turn off support diagnostics and stop it from informing support services about client failure.

According to the Group Policy Administrative Templates Catalog, “This policy setting determines whether Outlook can communicate client information on failure to support services with the intent of diagnosing the issue or making the information available to support to help with the diagnosis/resolution of the issue and/or provide contextual error messaging to the user.”

A different flaw that can prohibit users from configuring Exchange Online mailboxes in Outlook for Windows is something Redmond claimed it was attempting to fix last week.

Early in October, the company started releasing a remedy for a different problem that has been causing Outlook for Microsoft 365 to freeze and crash after opening since August.

Continue Reading

Press Release

After discovering a credit card skimmer, Costco admits a data breach.

Published

on

After discovering a credit card skimmer, Costco admits a data breach.

Customers who recently made purchases at one of Costco Wholesale Corporation’s stores have received notification letters informing them that their credit card information may have been stolen.

According to Fortune 500 rankings, the retail giant—also known as Costco Wholesale and Costco—is an American multinational that runs a sizable chain of membership-only retail locations. It is the fifth-largest retailer in the world and the tenth-largest firm in the US by total revenue.

It runs e-commerce websites with 737 warehouses across the world that cater to the Americas, Europe, and Asia, among other global regions.

planted skimmer in the Costco warehouse
During a regular check by Costco staff, a credit card skimming device was found in one of the company’s warehouses, leading to the discovery of the breach.

The business got rid of the gadget, let the authorities know, and is now assisting the police in their investigation.

In breach notification letters, Costco informed possibly impacted customers that they had recently visited a Costco facility where a payment card skimming device had been found.

“Our member records show that throughout the possible operational period of the device, you swiped your payment card to make a purchase at the impacted terminal.”

probable theft of customer financial information
Costco said that if those who placed the card theft device had been successful in accessing the data prior to the skimmer being discovered and taken out, then consumers affected by the incident may have had their payment information stolen.

The magnetic stripe of your credit card, which contains your name, card number, card expiration date, and CVV, may have been obtained by unauthorised individuals if they were able to remove information from the device before it was identified, according to Costco.

Customers were given advice by the retailer to check their bank and credit card statements for fraudulent payments and alert the appropriate financial institutions to any suspect activities.

The total number of customers who were impacted or the warehouse where the skimmer device was discovered were not disclosed in the data breach notification letters sent to affected consumers.

Although the business withheld details on the incident’s exact timing, Costco customers have been complaining about fraudulent charges on their credit cards at least since February.

Continue Reading

Trending