Microsoft 365 outage, Bomb hoaxers in hijacked inboxes, Operation Endgame pulls malware plugs

Super Cyber Friday : "Hacking the Inevitable Cyber Panic" Add it to your calendar here ! LIVE on YouTube for Department of Know

Super Cyber Friday : "Hacking the Inevitable Cyber Panic" Add it to your calendar here !

LIVE on YouTube for Department of Know

In todays cybersecurity news...

Global Microsoft outage affects users worldwide

Thursday, Microsoft traced a big disruption to servers in the Americas and Europe failing automated health checks and being taken offline, pushing more traffic onto remaining systems. The outage disrupted Exchange, Teams, SharePoint, Copilot and other Microsoft 365 services. The company suspects configuration updates may have contributed to the failures but hasn't confirmed the cause. Microsoft tested an alternative health-check method that brought some affected servers back online, but full service has yet to be restored globally.

( Bleeping Computer )

Old Exchange runs out of reprieves

Microsoft says Exchange Server 2016 and 2019 should now be considered "permanently vulnerable." The company stopped testing them for security flaws and released their final patches October 13th, after extending paid support twice. November's fixes are only for Exchange Server Subscription Edition, and address nine vulnerabilities, including a critical remote code execution flaw. Microsoft isn't testing the older versions to see whether those flaws affect them. If your organization is still running either version, Microsoft says it's time to upgrade immediately.

Bomb hoaxers hide behind hijacked inboxes

An update to the very unfortunate European bomb hoaxes: Taiwan's Da-Yeh University suspended a compromised email account used to threaten thousands of schools Wednesday. Proofpoint says the threats it examined last week also came from hijacked accounts, which can pass email authentication checks and slip past spam filters. Investigators now face tracing logins that may be hidden behind VPNs, plus obtaining records across multiple countries. No government has identified who's responsible.

Operation Endgame pulls more malware plugs

Europol and law enforcement partners from nine countries seized 235 servers and 257 domains used by Gootloader, CastleRAT, and StealC. The latest Operation Endgame action targets tools that deliver malware, give attackers remote access, or steal credentials and other sensitive data, including for ransomware gangs. Authorities also found 6.4 million stolen victim datasets on the infrastructure. Victim information will be made available through services including Have I Been Pwned . Europol urged WordPress users to change credentials, enable multifactor authentication, and patch vulnerabilities.

Big thanks to our sponsor, Vanta

SilentAir taps Taiwan's calls and texts

( Infosecurity Magazine )

Section 702 shortcut resistance

27 civil liberties groups, led by Demand Progress , urged Congress to keep a straight renewal of Section 702 out of the annual defense policy bill. The surveillance law has lapsed, but a court authorization allows the searches to continue through March. The groups want a warrant requirement when officials for Americans' communications collected through surveillance of foreign targets. They say attaching renewal to a must-pass bill would cut short that debate.

App data puts police on your trail

A Bloomberg investigation highlighted by security analyst Bruce Schneier describes how police can locate people using data from everyday smartphone apps. Penlink 's Webloc tool draws on location information from weather, gaming, email, and religious apps. Company documents reviewed by Bloomberg say it can show where a phone has been over the past 12 months, with updates every hour. Investigators can also pick a place and time on a map to see which phones were there. That puts ordinary app location data to work as a police tracking tool.

( Schneier on Security )

BrickLink's outage still won't click

Lego-owned marketplace BrickLink has been offline since November 6th after what it calls "unusual activity." The site initially described the downtime as necessary work and said it would return November 9th, but that deadline passed. BrickLink says it's containing the issue, investigating what happened, and checking for related problems before reopening. It hasn't confirmed a cyberattack or given a new return date. In the meantime, buyers and sellers can't trade the spare bricks, discontinued parts, and minifigures the marketplace is known for.