Microsoft warns Exchange users over password spray attacks

Date:
Wed, 05 Oct 2022 15:42:11 +0000

Description:
Crooks are trying out endless username/password combos until one eventually works

FULL STORY ======================================================================

Password spray attacks against Microsoft Exchange users are on the rise, the company has warned, urging organizations to set up Authentication Policies as a mitigation measure.

In a Tech Community blog post discussing the issue, "the Exchange Team" said many of its customers that leverage basic authentication are being targeted.

The evidence I see every day clearly indicates that password spray attacks
are becoming more frequent, the blog said. As a result, the team decided to turn off basic auth in Exchange Online. Numbers game

A password spray attack is essentially a brute force assault in which threat actors use automation to try as many username/password combinations on the login screen, until they find one working combination. Unlike basic brute force attacks, though, password spray attacks constantly keep changing usernames, as well as source IPs, too. That prevents any security tools from locking the targeted accounts down.

It's a numbers game essentially, and computers are quite good at numbers. And as attacks go, it works, the blog added.

The protocols most commonly under attack are SMTP and IMAP, the researchers said, adding that POP, while being third on the list, is a far cry from the top two. Read more

Windows 11 now has much better protection against brute-force attacks

Brute-force attacks targeting MSSQL servers, Microsoft warns

These are the best email service providers right now

To make sure only known accounts can use basic auth with specific protocols, the Exchange Team suggests organizations set up Authentication Policies.
Start with SMTP and IMAP and do it today!, they say.

Brute force attacks are quite popular among threat actors, mostly because people are known to use the same username/password combination across a wide range of online services.

By compromising one service, and stealing its login data, threat actors can often compromise accounts on multiple platforms, obtaining a real treasure trove of data that enables them to engage in identity theft, and in some
case, even financial theft. These are the best security keys out there



======================================================================
Link to news story: https://www.techradar.com/news/microsoft-warns-exchange-users-over-password-sp ray-attacks/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)