8 ms·

We've got some information on the timeline (and a name) on one of the major exploits here: https://proxylogon.com/ https://proxylogon.com/ Some of the detail

We've got some information on the timeline (and a name) on one of the major exploits here: https://proxylogon.com/ https://proxylogon.com/ Some of the detail on where this is a mess - The relevant security update is only offered for the latest (-1) Cumulative Update for Exchange. So you can open Windows Update and it will say "fully updated and secured", but you're not. Complicating matters, Cumulative Updates for Exchange 2019 have to be done from the licensing portal, with a valid logon. So maybe you have a perfectly capable 24x7 tech team, but the guy who manages license acquisition is on leave today. This is how you may basically find yourself resorting to piracy to get this patched.

bombcar 6y ago
Reminiscent of Cisco IOS patches being stuck behind support contracts - and inaccessible to many until they pony up.
- oasisbob 6y ago
  It's been a while since I've had to deal with Cisco IOS, but IIRC they were always good about releasing security fixes to anyone upon a TAC request. For used devices off support contract, security incidents were a great opportunity to get free updates.
  - sneak 6y ago
    IIRC you needed a contract login to open TAC cases. I always just got copies of the .bins from friends who worked at places that had contracts. They didn't gate updates at that time by which model you bought, once you had access you could get firmware for anything Cisco.
    - oasisbob 6y ago
      Phone or email would work too, no contract required. > As a special customer service, and to improve the overall security of the Internet, Cisco may offer customers free software updates to address high-severity security problems. The decision to provide free software updates is made on a case-by-case basis. Refer to the Cisco security publication for details. Free software updates will typically be limited to Critical and High severity Cisco Security Advisories. > If Cisco has offered a free software update to address a specific issue, noncontract customers who are eligible for the update may obtain it by contacting the Cisco TAC using any of the means described in the General Security-Related Queries section of this document. https://tools.cisco.com/security/center/resources/security_vulnerability_policy.html https://tools.cisco.com/security/center/resources/security_v...
      - RedShift1 6y ago
        Can confirm this works, did this 3 times in the past. 2 times no questions asked, a 3rd time I first got a message that I didn't have a support contract, but got it after linking them the release notes of the firmware in question where it said Cisco would provide it for free.
    - spicyramen 6y ago
      Cisco support at Enterprise level expensive or not. The Best in industry, their support organization is literally moving to GCP because they know what to do. GCP don't know yet.
  - gbil 6y ago
    I can confirm that on personal devices with no support contract. You contacted them asking for an update image due to published vulnerabilities and they sent it over
gowld 6y ago
> So maybe you have a perfectly capable 24x7 tech team, OK > but the guy who manages license acquisition is on leave today. Then I wouldn't have "the" guy for anything.
- gostsamo 6y ago
  It is not the guy that's guilty, but you for having such bad organization that one guy under the buss is sinking the entire ship.
  - ericd 6y ago
    I think that's what they're saying - that the problem is that there is a single "the guy".
    - gostsamo 6y ago
      Then it should've been "wouldn't have a guy for anything". The issue with funny quips is that if you don't do them correctly ambiguity reigns supreme.
    - technion 6y ago
      I get what they're saying, but in the majority of organisations the persons who spends their entire day reading Adobe's EULA and counting Oracle client installations isn't considered the sort of role that anyone has ever considered needing redundancy or full time availability until this thing broke out.
    - Ensorceled 6y ago
      I’m pretty sure he’s saying that guy is the problem for not being available and should be fired. The way it’s worded, it’s not clear who has the correct interpretation.
  - hmottestad 6y ago
    I thought it was Microsoft that was guilty for hiding a security update in the licensing portal!
throwawayboise 6y ago
> the guy who manages license acquisition is on leave today At that point, if you really have no other options, you pull the network plug. Or firewall it to internal-only. Email can wait for a day. And the nice thing about the protocol is that it will all get re-sent automatically.
- posguy 6y ago
  This depends on the sender's mailserver to cache the mail for a day (or a full weekend) without rejecting it. Some mailservers will kickback mail much sooner.
  - upofadown 6y ago
    Such servers are then not compliant with the standard of 4-5 days. See RFC 5321 sec 4.5.4.1. Are non-standard retry intervals actually that common?
- jsilence 6y ago
  Try telling the whole company email can wait a day. Good luck!
  - hansel_der 6y ago
    this! i cannot fathom any executive choosing the shutdown of email sevices over some risk that something might happen.
    - ganzuul 6y ago
      Haven't there been incarcerations due to gross negligence like that?
      - pjc50 6y ago
        No? Name one. (Managers are very rarely jailed for anything except the most deliberate fraud; even negligence that gets people killed is routinely not punished at all)
ocdtrekkie 6y ago
Huh, this appears to be a change they made for 2019... the downloads for 2016 CUs, including the latest ones, are available publicly: https://www.microsoft.com/en-us/download/details.aspx?id=102532 https://www.microsoft.com/en-us/download/details.aspx?id=102...
- phatfish 6y ago
  Yeah this is not the case for 2013/2016, although Exchange CUs are a full installer you can run a fresh install from. Unusual for Microsoft software updates in that respect I believe, and it kind of makes sense that would require a valid license to download. Clearly is is less customer friendly than 2016, but then Microsoft do REALLY want that sweet reoccurring subscription for Office 365 (or is it Microsoft 365 now?). Can't make it too easy to host your own Exchange server these days...

bombcar 6y ago

Reminiscent of Cisco IOS patches being stuck behind support contracts - and inaccessible to many until they pony up.

oasisbob 6y ago
It's been a while since I've had to deal with Cisco IOS, but IIRC they were always good about releasing security fixes to anyone upon a TAC request. For used devices off support contract, security incidents were a great opportunity to get free updates.
- sneak 6y ago
  IIRC you needed a contract login to open TAC cases. I always just got copies of the .bins from friends who worked at places that had contracts. They didn't gate updates at that time by which model you bought, once you had access you could get firmware for anything Cisco.
  - oasisbob 6y ago
    Phone or email would work too, no contract required. > As a special customer service, and to improve the overall security of the Internet, Cisco may offer customers free software updates to address high-severity security problems. The decision to provide free software updates is made on a case-by-case basis. Refer to the Cisco security publication for details. Free software updates will typically be limited to Critical and High severity Cisco Security Advisories. > If Cisco has offered a free software update to address a specific issue, noncontract customers who are eligible for the update may obtain it by contacting the Cisco TAC using any of the means described in the General Security-Related Queries section of this document. https://tools.cisco.com/security/center/resources/security_vulnerability_policy.html https://tools.cisco.com/security/center/resources/security_v...
    - RedShift1 6y ago
      Can confirm this works, did this 3 times in the past. 2 times no questions asked, a 3rd time I first got a message that I didn't have a support contract, but got it after linking them the release notes of the firmware in question where it said Cisco would provide it for free.
  - spicyramen 6y ago
    Cisco support at Enterprise level expensive or not. The Best in industry, their support organization is literally moving to GCP because they know what to do. GCP don't know yet.
- gbil 6y ago
  I can confirm that on personal devices with no support contract. You contacted them asking for an update image due to published vulnerabilities and they sent it over

gowld 6y ago

> So maybe you have a perfectly capable 24x7 tech team, OK > but the guy who manages license acquisition is on leave today. Then I wouldn't have "the" guy for anything.

gostsamo 6y ago
It is not the guy that's guilty, but you for having such bad organization that one guy under the buss is sinking the entire ship.
- ericd 6y ago
  I think that's what they're saying - that the problem is that there is a single "the guy".
  - gostsamo 6y ago
    Then it should've been "wouldn't have a guy for anything". The issue with funny quips is that if you don't do them correctly ambiguity reigns supreme.
  - technion 6y ago
    I get what they're saying, but in the majority of organisations the persons who spends their entire day reading Adobe's EULA and counting Oracle client installations isn't considered the sort of role that anyone has ever considered needing redundancy or full time availability until this thing broke out.
  - Ensorceled 6y ago
    I’m pretty sure he’s saying that guy is the problem for not being available and should be fired. The way it’s worded, it’s not clear who has the correct interpretation.
- hmottestad 6y ago
  I thought it was Microsoft that was guilty for hiding a security update in the licensing portal!

throwawayboise 6y ago

> the guy who manages license acquisition is on leave today At that point, if you really have no other options, you pull the network plug. Or firewall it to internal-only. Email can wait for a day. And the nice thing about the protocol is that it will all get re-sent automatically.

posguy 6y ago
This depends on the sender's mailserver to cache the mail for a day (or a full weekend) without rejecting it. Some mailservers will kickback mail much sooner.
- upofadown 6y ago
  Such servers are then not compliant with the standard of 4-5 days. See RFC 5321 sec 4.5.4.1. Are non-standard retry intervals actually that common?
jsilence 6y ago
Try telling the whole company email can wait a day. Good luck!
- hansel_der 6y ago
  this! i cannot fathom any executive choosing the shutdown of email sevices over some risk that something might happen.
  - ganzuul 6y ago
    Haven't there been incarcerations due to gross negligence like that?
    - pjc50 6y ago
      No? Name one. (Managers are very rarely jailed for anything except the most deliberate fraud; even negligence that gets people killed is routinely not punished at all)

ocdtrekkie 6y ago

Huh, this appears to be a change they made for 2019... the downloads for 2016 CUs, including the latest ones, are available publicly: https://www.microsoft.com/en-us/download/details.aspx?id=102532 https://www.microsoft.com/en-us/download/details.aspx?id=102...

phatfish 6y ago
Yeah this is not the case for 2013/2016, although Exchange CUs are a full installer you can run a fresh install from. Unusual for Microsoft software updates in that respect I believe, and it kind of makes sense that would require a valid license to download. Clearly is is less customer friendly than 2016, but then Microsoft do REALLY want that sweet reoccurring subscription for Office 365 (or is it Microsoft 365 now?). Can't make it too easy to host your own Exchange server these days...