X

Aggregator

'Tens of Thousands' of SharePoint Servers at Risk. Microsoft Issues No Patch

Slashdot
1 month ago
"Anybody who's got a hosted SharePoint server has got a problem," the senior VP of cybersecurity firm CrowdStrike told the Washington Post. "It's a significant vulnerability." And it's led to a new "global attack on government agencies and businesses" in the last few days, according to the article, "breaching U.S. federal and state agencies, universities, energy companies and an Asian telecommunications company, according to state officials and private researchers..." "Tens of thousands of such servers are at risk, experts said, and Microsoft has issued no patch for the flaw, leaving victims around the world scrambling to respond." (Microsoft says they are "working on" security updates "for supported versions of SharePoint 2019 and SharePoint 2016," offering various mitigation suggestions, and CISA has released their own recommendations.) From the Washington Post's article Sunday: Microsoft has suggested that users make modifications to SharePoint server programs or simply unplug them from the internet to stanch the breach. Microsoft issued an alert to customers but declined to comment further... "We are seeing attempts to exploit thousands of SharePoint servers globally before a patch is available," said Pete Renals, a senior manager with Palo Alto Networks' Unit 42. "We have identified dozens of compromised organizations spanning both commercial and government sectors.'' With access to these servers, which often connect to Outlook email, Teams and other core services, a breach can lead to theft of sensitive data as well as password harvesting, Netherlands-based research company Eye Security noted. What's also alarming, researchers said, is that the hackers have gained access to keys that may allow them to regain entry even after a system is patched. "So pushing out a patch on Monday or Tuesday doesn't help anybody who's been compromised in the past 72 hours," said one researcher, who spoke on the condition of anonymity because a federal investigation is ongoing. The breaches occurred after Microsoft fixed a security flaw this month. The attackers realized they could use a similar vulnerability, according to the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency. CISA spokeswoman Marci McCarthy said the agency was alerted to the issue Friday by a cyber research firm and immediately contacted Microsoft... The nonprofit Center for Internet Security, which staffs an information-sharing group for state and local governments, notified about 100 organizations that they were vulnerable and potentially compromised, said Randy Rose, the organization's vice president. Those warned included public schools and universities. Others that were breached included a government agency in Spain, a local agency in Albuquerque and a university in Brazil, security researchers said. But there's many more breaches, according to the article: "Eye Security said it has tracked more than 50 breaches, including at an energy company in a large state and several European government agencies." "At least two U.S. federal agencies have seen their servers breached, according to researchers." "One state official in the eastern U.S. said the attackers had 'hijacked' a repository of documents provided to the public to help residents understand how their government works. The agency involved can no longer access the material..." "It was not immediately clear who is behind the hacking of global reach or what its ultimate goal is. One private research company found the hackers targeting servers in China..."

Read more of this story at Slashdot.

EditorDavid

After 'Superman' Scores $400M Globally, How Will Marvel Respond?

Slashdot
1 month ago
Marvel Studios president Kevin Feige "isn't interested in your theories of superhero fatigue, which he doesn't buy as real," writes The Hollywood Reporter. Feige points to the $400 million worldwide box office for Superman (which another article notes in only its second weekend "has already passed up the entire lifetime run of Marvel's Thunderbolts*.") So how is Marvel moving forward? Yes, Feige knows Marvel made too many movies and shows (and the other things they did wrong). From the first Iron Man in 2008 through Avengers: Endgame in 2019, Marvel produced around 50 hours of screen storytelling. In the six years since Endgame, the number jumps to an astounding 102 hours of movies and television. 127 hours if you include animation. "That's too much," Feige said. He characterized the time period after Endgame as an era of experimentation, evolution and, unfortunately, expansion. And while he's proud of the experimentation — he points to WandaVision and Loki as some of the best stories they've made — he admits "It's the expansion that is certainly what devalued" that output. Being high on success also may have pushed them to readily agree to try to deliver more programming at a time when Disney and the rest of Hollywood were engaged in the streaming wars. "It was a big company push... [T]here was a mandate that we were put in the middle of, but we also thought it'd be fun to bring these to life." Marvel has already pulled back the amount of movies and shows it will make. Some years may even only have one movie. Certainly there will be years with only one show released. Also, Marvel has started "grinding down" on budgets, with movies costing up to a third cheaper than the films from 2022 or 2023. Feige also explains why Thunderbolts* struggled at the box office (even though he's called it a "very, very good movie"). The massive expansion into television and focus on Disney+ led to the feeling that watching Marvel was becoming a type of homework. "It's that expansion that I think led people to say, 'Do I have to see all of these? It used to be fun, but now do I have to know everything about all of these?' And I think The Marvels hit it hardest where people are like, 'Okay, I recognize her from a billion dollar movie. But who are those other two? I guess they were in some TV show. I'll skip it.'" Which had an effect on Thunderbolts*, which featured characters that were seen on various platforms, including some only on shows. The article notes Friday's release of Fantastic Four: First Steps is Marvel Studios' first crack at the characters after "a trio of movies of various quality and box office made by Twentieth Century Fox before its 2019 acquisition by Disney." And the article also acknowledges "the never-released, 1994 feature produced low-budget king Roger Corman. (Fun fact: the four stars of that movie cameo in Fantastic Four: First Steps.)"

Read more of this story at Slashdot.

EditorDavid