'Anomalous surge in DNS queries' knocked Microsoft's cloud off the web last week

Plus: Top universities hit by data-stealing extortionists


in Brief It was a tsunami of DNS queries that ultimately took out a host of Microsoft services, from Xbox Live to Teams, for some netizens about an hour on April Fools' Day, Redmond has said.

Or as the Windows giant put it, the outage was the result of "an anomalous surge in DNS queries from across the globe targeting a set of domains hosted on Azure." In a postmortem examination of the downtime, Microsoft said the flood of requests triggered a programming flaw in its infrastructure that hampered its ability to cope with the demand:

Normally, Azure’s layers of caches and traffic shaping would mitigate this surge. In this incident, one specific sequence of events exposed a code defect in our DNS service that reduced the efficiency of our DNS Edge caches. As our DNS service became overloaded, DNS clients began frequent retries of their requests which added workload to the DNS service. Since client retries are considered legitimate DNS traffic, this traffic was not dropped by our volumetric spike mitigation systems. This increase in traffic led to decreased availability of our DNS service.

Microsoft says it has now fixed the bug "so that all requests can be efficiently handled in cache," and improved "the automatic detection and mitigation of anomalous traffic patterns."

North Koreans go after infosec bods again

In January, Google warned that suspected North Korean government cyber-spies were preying on security researchers. On Wednesday last week, it said the dastardly team was trying a new tactic.

The web giant's Threat Analysis Group said it had detected in March a bogus security company SecuriElite reaching out to legit professionals via social media, such as LinkedIn and Twitter.

"Like previous websites we’ve seen set up by this actor, this website has a link to their PGP public key at the bottom of the page," the Google analysts said. "In January, targeted researchers reported that the PGP key hosted on the attacker’s blog acted as the lure to visit the site where a browser exploit was waiting to be triggered."

Going after security investigators is a high-risk/high-reward endeavor. On the one hand, they are more likely to be careful about possible dangers, but you only have to make one mistake and then there's a host of vulnerability and exploit research material and contacts to be harvested from your compromised victim. With Google's latest warning, it's time to set shields to maximum if not already.

Microsoft sets new baseline for 365 enterprise apps

Admins with a Windows-heavy focus might want to check out the latest Redmond missive on planned security changes for Microsoft 365 apps in the forthcoming version 2103.

While these are draft proposals at the moment, they are going to cause some disruption. Dynamic Data Exchange for Excel is out across the board, JScript execution for Office is going to come under tighter lockdown to avoid the execution of arbitrary code, and there's more action against macros.

Defender's also toughening its stance on dodgy-looking documents, which has led to some false positive problems in the past. So check out the specs, and make views known – maybe Microsoft will listen.

DeepDotWeb admin pleads guilty

An IT admin who ran operations for DeepDotWeb – a portal that pointed netizens at dark web marketplaces selling malware, guns, and drugs – pleaded guilty to money laundering charges this month.

Tal Prihar, 37, an Israeli citizen living in Brazil, set up the DeepDotWeb portal in October 2013 with co-defendant Michael Phan, 34, of Israel, and while they didn't deal in illegal goods personally, they linked to those who did, and received $8.4m in kickbacks to promote certain dodgy sites, prosecutors said. The portal was taken down in May 2019 after a combined operation by Europol, and Israeli and US law enforcement.

"For six years, DeepDotWeb was a gateway to facilitate the illegal purchase of items to include dangerous drugs, weapons, and malicious software,” said Acting Special Agent in Charge Carlton Peeples of the FBI’s Pittsburgh Field Office. “Prihar profited as a byproduct from other people’s dangerous transactions and today’s guilty plea sends a message to other cyber actors across the globe who think the dark web is a safe haven."

Prihar has agreed to forfeit $8,414,173 in funds, and will be sentenced in August. Phan's case is pending.

Accellion hack just keeps on going: top-flight universities ransacked

Some of America's most technologically advanced halls of learning have been hit by extortionists who cruise the internet exploiting vulnerable deployments of the Accellion file-transfer software to steal organizations' internal secrets and other data. The Clop crooks, which have hit governments and big biz, then demand payment to keep a lid on the purloined records.

Stanford, the University of California, including UC Berkeley, and others have had personal information stolen. Gigabytes of stolen data has been uploaded to the dark web to encourage the colleges to pay a ransom to prevent all of the data from being dumped online. Students are also being harassed by the extortionists via email.

"We believe the person(s) behind this attack are sending threatening mass emails to members of the UC community in an attempt to scare people into giving them money. The message states: 'Your personal data has been stolen and will be published,'" said UC Davis.

The universities are advising the usual measures: password changes, multifactor authentication, and credit checks.

Fortinet software stalked by snoops

The FBI and America's Cybersecurity and Infrastructure Security Agency (CISA) rounded off last week with a warning [PDF] on Friday that installations of Fortinet's FortiOS SSL VPN portal were being actively probed for unpatched security flaws by top-tier miscreants, known in industry jargon as an advanced persistent threat (APT). The snoops seem to be hoping to exploit bugs assigned CVE-2018-13379, CVE-2020-12812 and CVE-2019-5591, we're told. Patches have been available for these holes for a long while, and should be installed by now.

"It is likely that the APT actors are scanning for these vulnerabilities to gain access to multiple government, commercial, and technology services networks," the agencies said.

"The APT actors may be using any or all of these CVEs to gain access to networks across multiple critical infrastructure sectors to gain access to key networks as pre-positioning for follow-on data exfiltration or data encryption attacks."

US Homeland Security warned about the exploitation of the key Fortinet flaw, CVE 2018-13379, in December. We're told the attackers are chaining that flaw with an LDAP impersonation vulnerability (CVE-2019-5591) and an authentication bypass (CVE-2020-12812) to infiltrate networks. ®

Similar topics


Other stories you might like

  • NASA's InSight doomed as Mars dust coats solar panels
    The little lander that couldn't (any longer)

    The Martian InSight lander will no longer be able to function within months as dust continues to pile up on its solar panels, starving it of energy, NASA reported on Tuesday.

    Launched from Earth in 2018, the six-metre-wide machine's mission was sent to study the Red Planet below its surface. InSight is armed with a range of instruments, including a robotic arm, seismometer, and a soil temperature sensor. Astronomers figured the data would help them understand how the rocky cores of planets in the Solar System formed and evolved over time.

    "InSight has transformed our understanding of the interiors of rocky planets and set the stage for future missions," Lori Glaze, director of NASA's Planetary Science Division, said in a statement. "We can apply what we've learned about Mars' inner structure to Earth, the Moon, Venus, and even rocky planets in other solar systems."

    Continue reading
  • The ‘substantial contributions’ Intel has promised to boost RISC-V adoption
    With the benefit of maybe revitalizing the x86 giant’s foundry business

    Analysis Here's something that would have seemed outlandish only a few years ago: to help fuel Intel's future growth, the x86 giant has vowed to do what it can to make the open-source RISC-V ISA worthy of widespread adoption.

    In a presentation, an Intel representative shared some details of how the chipmaker plans to contribute to RISC-V as part of its bet that the instruction set architecture will fuel growth for its revitalized contract chip manufacturing business.

    While Intel invested in RISC-V chip designer SiFive in 2018, the semiconductor titan's intentions with RISC-V evolved last year when it revealed that the contract manufacturing business key to its comeback, Intel Foundry Services, would be willing to make chips compatible with x86, Arm, and RISC-V ISAs. The chipmaker then announced in February it joined RISC-V International, the ISA's governing body, and launched a $1 billion innovation fund that will support chip designers, including those making RISC-V components.

    Continue reading
  • FBI warns of North Korean cyberspies posing as foreign IT workers
    Looking for tech talent? Kim Jong-un's friendly freelancers, at your service

    Pay close attention to that resume before offering that work contract.

    The FBI, in a joint advisory with the US government Departments of State and Treasury, has warned that North Korea's cyberspies are posing as non-North-Korean IT workers to bag Western jobs to advance Kim Jong-un's nefarious pursuits.

    In guidance [PDF] issued this week, the Feds warned that these techies often use fake IDs and other documents to pose as non-North-Korean nationals to gain freelance employment in North America, Europe, and east Asia. Additionally, North Korean IT workers may accept foreign contracts and then outsource those projects to non-North-Korean folks.

    Continue reading
  • Google opens the pod doors on Bay View campus
    A futuristic design won't make people want to come back – just ask Apple

    After nearly a decade of planning and five years of construction, Google is cutting the ribbon on its Bay View campus, the first that Google itself designed.

    The Bay View campus in Mountain View – slated to open this week – consists of two office buildings (one of which, Charleston East, is still under construction), 20 acres of open space, a 1,000-person event center and 240 short-term accommodations for Google employees. The search giant said the buildings at Bay View total 1.1 million square feet. For reference, that's less than half the size of Apple's spaceship. 

    The roofs on the two main buildings, which look like pavilions roofed in sails, were designed that way for a purpose: They're a network of 90,000 scale-like solar panels nicknamed "dragonscales" for their layout and shimmer. By scaling the tiles, Google said the design minimises damage from wind, rain and snow, and the sloped pavilion-like roof improves solar capture by adding additional curves in the roof. 

    Continue reading
  • Pentester pops open Tesla Model 3 using low-cost Bluetooth module
    Anything that uses proximity-based BLE is vulnerable, claim researchers

    Tesla Model 3 and Y owners, beware: the passive entry feature on your vehicle could potentially be hoodwinked by a relay attack, leading to the theft of the flash motor.

    Discovered and demonstrated by researchers at NCC Group, the technique involves relaying the Bluetooth Low Energy (BLE) signals from a smartphone that has been paired with a Tesla back to the vehicle. Far from simply unlocking the door, this hack lets a miscreant start the car and drive away, too.

    Essentially, what happens is this: the paired smartphone should be physically close by the Tesla to unlock it. NCC's technique involves one gadget near the paired phone, and another gadget near the car. The phone-side gadget relays signals from the phone to the car-side gadget, which forwards them to the vehicle to unlock and start it. This shouldn't normally happen because the phone and car are so far apart. The car has a defense mechanism – based on measuring transmission latency to detect that a paired device is too far away – that ideally prevents relayed signals from working, though this can be defeated by simply cutting the latency of the relay process.

    Continue reading
  • Google assuring open-source code to secure software supply chains
    Java and Python packages are the first on the list

    Google has a plan — and a new product plus a partnership with developer-focused security shop Snyk — that attempts to make it easier for enterprises to secure their open source software dependencies.

    The new service, announced today at the Google Cloud Security Summit, is called Assured Open Source Software. We're told it will initially focus on some Java and Python packages that Google's own developers prioritize in their workflows. 

    These two programming languages have "particularly high-risk profiles," Google Cloud Cloud VP and GM Sunil Potti said in response to The Register's questions. "Remember Log4j?" Yes, quite vividly.

    Continue reading
  • Rocket Lab is taking NASA's CAPSTONE to the Moon
    Mission to lunar orbit is further than any Photon satellite bus has gone before

    Rocket Lab has taken delivery of NASA's CAPSTONE spacecraft at its New Zealand launch pad ahead of a mission to the Moon.

    It's been quite a journey for CAPSTONE [Cislunar Autonomous Positioning System Technology Operations and Navigation Experiment], which was originally supposed to launch from Rocket Lab's US launchpad at Wallops Island in Virginia.

    The pad, Launch Complex 2, has been completed for a while now. However, delays in certifying Rocket Lab's Autonomous Flight Termination System (AFTS) pushed the move to Launch Complex 1 in Mahia, New Zealand.

    Continue reading
  • Alibaba Cloud adds third datacenter in Germany
    More Euro-presence than any other Chinese company, but still nowhere near Google or AWS

    Alibaba has pulled ahead of its Chinese rivals in Europe with the opening of a third datacenter in Germany.

    The company said the Frankfurt datacenter serves cloud computing products to Europe and "adheres to the highest security standards and the strict compliance regulations set out in the Cloud Computing Compliance Controls Catalog (C5) in Germany."

    The addition brings Alibaba Cloud to a network of 84 availability zones in 27 regions worldwide. The company's first European cloud center arrived in Frankfurt in 2016.

    Continue reading

Biting the hand that feeds IT © 1998–2022