4 ms·

Zimbra 0-day used to steal email data from government organizations

133 points by hasheddan 3y ago

kstrauser 3y ago
Oh, XSS. It’s the gift that keeps giving.
- j45 3y ago
  At some point I’m hoping AI can help with hardening by coming up with potentially novel security holes.
  - kstrauser 3y ago
    Right? Let's see some Hex Color Injection or Retina Inversion or Bytecode Reversal attacks. I want to see a flatline riding a black chrome shark into my browser. Enough of this "XSS" this and "Server-Side Request Forgery" that stuff.
    - j45 3y ago
      As much as I got downvoted, the botnets that attack servers are going to greatly evolve. And it’s not personal.
      - kstrauser 3y ago
        I was surprised that you were. What you're describing is inevitable.
        j45 3y ago
        Can’t please everyone
  - Obscurity4340 3y ago
    Is there very much a usecase for using AI to Xray a site and find all this bullshit in an automated fashion? The opposite seems so unreliable and unfashionable...
    - j45 3y ago
      I would start with asking the cybersecurityists
- deleted 3y ago
  [deleted]
deleted 3y ago
[deleted]
dang 3y ago
[stub for offtopicness]
- mmoya 3y ago
  Post deleted, archive.org has it https://web.archive.org/web/20231116160518/https://blog.google/threat-analysis-group/zimbra-0-day-used-to-steal-email-data-from-government-organizations/ https://web.archive.org/web/20231116160518/https://blog.goog...
  - aa_is_op 3y ago
    Nah. It's live. Their CDN had a hiccup.
- kyrra 3y ago
  Odd, looks like it was deleted? It's on archive.org though. https://web.archive.org/web/20231116160518/https://blog.google/threat-analysis-group/zimbra-0-day-used-to-steal-email-data-from-government-organizations/ https://web.archive.org/web/20231116160518/https://blog.goog... EDIT: updated URL here: https://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/ https://blog.google/threat-analysis-group/zimbra-0-day-used-...
- blakesterz 3y ago
  I think the URL just changed to https://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/ https://blog.google/threat-analysis-group/zimbra-0-day-used-...
  - dang 3y ago
    Fixed now. Submitted URL was https://blog.google/threat-analysis-group/zimbra-0-day-used-to-steal-email-data-from-government-organizations/ https://blog.google/threat-analysis-group/zimbra-0-day-used-.... Thanks!
dspillett 3y ago
This is a timely reminder to anyone still using Zimbra 8.x.x that is reaches EOL at the end of next month. There is no official open release of later versions despite much being covered by open source licenses. If you have not already moved off Zimbra you need to, ASAP, do one of the following: 1. Pay for Zimbra and upgrade that way. 2. Try compile up a later version yourself… 3. Migrate to one of the forks that sprang up (most of them are dead though, Zextras/Carbonio is still going but last time I looked the system requirements were a bit daft for what little functionality I actually need) 4. Migrate to something else entirely.
- jsilence 3y ago
  Not sure what you are talking about. To me it looks like you can just DL and install 9.0 or 10.0 community release. Am I missing something? https://www.zimbra.com/product/download/zimbra-collaboration-network-edition/ https://www.zimbra.com/product/download/zimbra-collaboration...
  - slipheen 3y ago
    Looking at the links on that page, the only links for 9.0 or 10.0 look to be for the network edition (non oss) I'm not familiar with the situation, but reading through https://blog.zimbra.com/2020/05/is-zimbra-open-source-yes-faqs-about-zimbra-ose-for-you/ https://blog.zimbra.com/2020/05/is-zimbra-open-source-yes-fa... suggests that they do still provide source for at least some portions of 9.x, but they no longer provide binaries or packages. It looks like some components may be missing ("Modern UI"), but I don't know if it's usable without them.
  - deleted 3y ago
    [deleted]
  - deleted 3y ago
    [deleted]
  - dspillett 3y ago
    9.0 onwards never has a “community edition” release so people self-hosting that rather than paying for licensing for “network edition” have stuck at 8.x. Note that there are two downloads for 8.8.15 on the linked page, one of which is marked “open source”. Anyone who is still there has been getting security updates, but that stops being the case once 8.8.15 hits EOL.
willk 3y ago
It feels like they waited a long time to post an advisory for an exploit that was being actively used by threat actors, more than a week after they pushed a fix to their repositories. Why not give customers a heads up prior? At least give your users a fighting chance.
- panarky 3y ago
  > The patch for the vulnerability was pushed to Github on July 5. Another actor exploited the vulnerability for a full two weeks beginning on July 11 before the official patch became available on July 25. What's the point of a responsible disclosure embargo policy when the enterprise software developer alerts threat actors of the precise vuln three full weeks before they even begin to patch their customers' systems?

133 points by hasheddan 3y ago

kstrauser 3y ago

Oh, XSS. It’s the gift that keeps giving.

j45 3y ago
At some point I’m hoping AI can help with hardening by coming up with potentially novel security holes.
- kstrauser 3y ago
  Right? Let's see some Hex Color Injection or Retina Inversion or Bytecode Reversal attacks. I want to see a flatline riding a black chrome shark into my browser. Enough of this "XSS" this and "Server-Side Request Forgery" that stuff.
  - j45 3y ago
    As much as I got downvoted, the botnets that attack servers are going to greatly evolve. And it’s not personal.
    - kstrauser 3y ago
      I was surprised that you were. What you're describing is inevitable.
      - j45 3y ago
        Can’t please everyone
- Obscurity4340 3y ago
  Is there very much a usecase for using AI to Xray a site and find all this bullshit in an automated fashion? The opposite seems so unreliable and unfashionable...
  - j45 3y ago
    I would start with asking the cybersecurityists
deleted 3y ago
[deleted]

deleted 3y ago

[deleted]

dang 3y ago

[stub for offtopicness]

mmoya 3y ago
Post deleted, archive.org has it https://web.archive.org/web/20231116160518/https://blog.google/threat-analysis-group/zimbra-0-day-used-to-steal-email-data-from-government-organizations/ https://web.archive.org/web/20231116160518/https://blog.goog...
- aa_is_op 3y ago
  Nah. It's live. Their CDN had a hiccup.
kyrra 3y ago
Odd, looks like it was deleted? It's on archive.org though. https://web.archive.org/web/20231116160518/https://blog.google/threat-analysis-group/zimbra-0-day-used-to-steal-email-data-from-government-organizations/ https://web.archive.org/web/20231116160518/https://blog.goog... EDIT: updated URL here: https://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/ https://blog.google/threat-analysis-group/zimbra-0-day-used-...
blakesterz 3y ago
I think the URL just changed to https://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/ https://blog.google/threat-analysis-group/zimbra-0-day-used-...
- dang 3y ago
  Fixed now. Submitted URL was https://blog.google/threat-analysis-group/zimbra-0-day-used-to-steal-email-data-from-government-organizations/ https://blog.google/threat-analysis-group/zimbra-0-day-used-.... Thanks!

dspillett 3y ago

This is a timely reminder to anyone still using Zimbra 8.x.x that is reaches EOL at the end of next month. There is no official open release of later versions despite much being covered by open source licenses. If you have not already moved off Zimbra you need to, ASAP, do one of the following: 1. Pay for Zimbra and upgrade that way. 2. Try compile up a later version yourself… 3. Migrate to one of the forks that sprang up (most of them are dead though, Zextras/Carbonio is still going but last time I looked the system requirements were a bit daft for what little functionality I actually need) 4. Migrate to something else entirely.

jsilence 3y ago
Not sure what you are talking about. To me it looks like you can just DL and install 9.0 or 10.0 community release. Am I missing something? https://www.zimbra.com/product/download/zimbra-collaboration-network-edition/ https://www.zimbra.com/product/download/zimbra-collaboration...
- slipheen 3y ago
  Looking at the links on that page, the only links for 9.0 or 10.0 look to be for the network edition (non oss) I'm not familiar with the situation, but reading through https://blog.zimbra.com/2020/05/is-zimbra-open-source-yes-faqs-about-zimbra-ose-for-you/ https://blog.zimbra.com/2020/05/is-zimbra-open-source-yes-fa... suggests that they do still provide source for at least some portions of 9.x, but they no longer provide binaries or packages. It looks like some components may be missing ("Modern UI"), but I don't know if it's usable without them.
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
- dspillett 3y ago
  9.0 onwards never has a “community edition” release so people self-hosting that rather than paying for licensing for “network edition” have stuck at 8.x. Note that there are two downloads for 8.8.15 on the linked page, one of which is marked “open source”. Anyone who is still there has been getting security updates, but that stops being the case once 8.8.15 hits EOL.

willk 3y ago

It feels like they waited a long time to post an advisory for an exploit that was being actively used by threat actors, more than a week after they pushed a fix to their repositories. Why not give customers a heads up prior? At least give your users a fighting chance.

panarky 3y ago
> The patch for the vulnerability was pushed to Github on July 5. Another actor exploited the vulnerability for a full two weeks beginning on July 11 before the official patch became available on July 25. What's the point of a responsible disclosure embargo policy when the enterprise software developer alerts threat actors of the precise vuln three full weeks before they even begin to patch their customers' systems?