Microsoft called out as big malware hoster – thanks to OneDrive and Office 365 abuse
- Reference: 1634578207
- News link: https://www.theregister.co.uk/2021/10/18/microsoft_malware_brand/
- Source link:
Infosec expert Kevin Beaumont, who worked at Microsoft as a senior threat intelligence analyst between June 2020 and April 2021, made the comments in response to a report by "cybersec professional" TheAnalyst.
TheAnalyst [1]noted that a BazarLoader malware campaign was hosting its malware on Microsoft's OneDrive service. "Does Microsoft have any responsibility in this when they KNOWINGLY are hosting hundreds of files leading to this, now for over three days?" they asked.
[2]
[3]BazarLoader is a family of malware where a spam email attempts to trick recipients into opening a trojan via a link, in this case to an ISO (disk image that can be mounted with one click) containing a malicious DLL with a misleading shortcut called Documents that runs it, leading in time to a potential ransomware attack using [4]Conti .
[5]
[6]
"Amusingly, while at MS we built a pipeline to alert Google Drive about Bazarloader to have the links taken down, hence why it happened so quickly (literally minutes). Now they've moved to Microsoft infrastructure, who have the pipeline, but can't get Office to remove the files," [7]said Beaumont.
Adding to the misery, "Microsoft's documentation specifically tells you to allowlist domains in question so security solutions don't inspect the content. Try defending a business with a situation like this," [8]challenged Beaumont.
[9]
He [10]added that "Microsoft cannot advertise themselves as the security leader with 8,000 security employees and trillions of signals if they cannot prevent their own Office365 platform being directly used to launch Conti ransomware. OneDrive abuse has been going on for years."
[11]
Average reaction time to malware reports: Microsoft is among the worst, and Google is also very poor
A site called URLhaus, maintained by Swiss project abuse.ch at the Bern University Institute for Cybersecurity and Engineering, keeps [12]statistics on how long it takes for malware to be removed by the site which hosts it. The latest statistics show that Microsoft has the worst reaction time of any in the top ten sites hosting the most malware urls, at over 29 days.
According to the figures, Google hosts more malware and is also slow to remove it, but with a 14-day response time it is twice as quick as Microsoft.
[13]
Malware hosted on OneDrive, reported to URLhaus
The official Twitter account of abuse.ch, which runs URLhaus, [14]said "for the record, the oldest active malware site with an age of 19 months is hosted on Sharepoint and serving GuLoader." It added: "I've seen an increase of 10 new malware sites hosted at MS over the weekend. Whatever they do with these reports filled out through the MSRC API, it is definitely not automated." MSRC is the Microsoft Security Response Center.
Beaumont [15]said that while "My experience is the Azure Storage items should disappear very quickly ... unfortunately Office is in a mess"
The Microsoft sites hosting malware use OneDrive accounts that might have been created specifically for the purpose, or hijacked from legitimate users. It is also common to see malware hosted on business Office 365 accounts that have been compromised.
Automated blocking of suspicious files by the cloud providers is problematic not only because new variants are hard to detect, but also for privacy reasons. Even if malware is detected by Microsoft Defender, it is not "automatically taken down in OneDrive," Beaumont [16]said .
[17]
The reaction time measures how long it takes to remove malicious content following a specific report, and is an average time to remove the malware; the [18]full list shows that some reports take just two days and others up to 4 months.
The message for users is that seeing a link is hosted on a familiar name like OneDrive or Google Drive is not a reason to have confidence that it is safe to open - and that allow-listing those domains is a mistake.
We have asked Microsoft for comment.®
Get our [19]Tech Resources
[1] https://twitter.com/ffforward/status/1448998616153083904
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YW3ujCMHHgWlpNv0hbUoqAAAAA4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2021/05/14/ireland_hse_ransomware_hospital_conti_wizardspider/
[4] https://us-cert.cisa.gov/ncas/alerts/aa21-265a
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YW3ujCMHHgWlpNv0hbUoqAAAAA4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YW3ujCMHHgWlpNv0hbUoqAAAAA4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://twitter.com/GossiTheDog/status/1449138609974611972
[8] https://twitter.com/GossiTheDog/status/1449517320691388418
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YW3ujCMHHgWlpNv0hbUoqAAAAA4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://twitter.com/GossiTheDog/status/1449087925740838922
[11] https://regmedia.co.uk/2021/10/18/urlhaus.jpg
[12] https://urlhaus.abuse.ch/statistics/#avg_takedown
[13] https://regmedia.co.uk/2021/10/18/malware.png
[14] https://twitter.com/abuse_ch/status/1449376593818931206
[15] https://twitter.com/GossiTheDog/status/1449985313393283072
[16] https://twitter.com/GossiTheDog/status/1449286338365300742
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YW3ujCMHHgWlpNv0hbUoqAAAAA4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[18] https://urlhaus.abuse.ch/statistics/reactiontime/
[19] https://whitepapers.theregister.com/
Re: Same for Phishing Attacks
I'm amazed, disgusted, & dismayed at all the attempts that land in my junk folder, and even moreso by the stuff that manages to get through. Since I'm blind & my screen reader renders all international domains into plain text, it's often ludicrously easy to realize that the embedded url claiming to be to one source actually goes to a different one. Am I going to click that link to someone else's onedrive/google docs account? Hell no. So I click the "report as spam" link & delete it from my email client.
I fear what sighted folks that don't bother to check such things wind up falling victim to, clicking links willy nilly as if they were safe & harmless.
I often wonder what the internet would be like if a common sense/IQ test were required to gain access. Given that evolution keeps creating better idiots, I'm not sure "idiot proofing" would do any good...
Re: Same for Phishing Attacks
I see items arrive in the Junk Mail folder that the email server has scanned and thought were clean - only a couple of days later when the AV software has been updated about a dozen times it finally detects an infection attempt in the junk mail folder.
We don't blame Facebook for posting stupid social media "information" - we just say that people are stupid for reading it. So we're not going to blame Onedrive for storing malware, we will only blame people for downloading it.
El Reg - can I have a wire-cutter icon for my posts please?
Users need to know that
Even if Microsoft and Google speed up their resolution of these things, someone is still going to put malware on anything which can distribute data. When I train users, which fortunately I just do informally, this is one of the things I try to get across. Links to a storage service are links to unknown content and no more trustworthy than a link to an unknown website. It's also worth knowing that people will use other tricks to make their content appear to come from a site users trust. I have seen a few attempts using Google Translate so the domain appears to be google.com but contains another domain in the query parameters which the web app will kindly render for the victim. Not all spam is obvious.
Same for Phishing Attacks
Some of the more dangerous phishing attacks I've seen include a fake Office 365 login form (an HTML document) hosted at Live.com or OneDrive.com.
Employees see the perfectly duplicated sign-in form, and when they double-check the browser bar they see the TLS lock symbol with a certificate for Microsoft Corporation.
It's a series of failures at every layer: poor spam filters allow emails that look an awful lot like they are from Microsft, which link to a ubiquitous (but faked) sign-on screen, hosted on servers that are certified as Microsoft. It goes even further if your admins added either site to the Trusted Domains list.
I loudly protest at the claim that Office 365 is more secure than its on-premises predecessors.