United Nations Data Breach Started with Microsoft SharePoint Bug

A cyberattack targeting United Nations offices in July 2019 reportedly stemmed from Microsoft SharePoint vulnerability CVE-2019-0604, which was patched early last year and has been under active attack since then. A senior UN IT official estimates some 400GB of data was downloaded.

News of the breach comes from a confidential document from the UN Office of Information and Technology. The file was leaked to The New Humanitarian and seen by the AP, which reports 42 servers were compromised and another 25 are considered suspicious. The majority of these servers are at the UN offices in Geneva and Vienna. Attackers were also able to access Active Directories, likely obtaining human resources, insurance systems, databases, and network data.

It's so far unclear exactly which documents and data the attackers stole; however, those who viewed the report imply internal documents, emails, databases, and commercial information may have been accessed. The sensitive nature of information handled by these offices could have major consequences for UN staff and the many people it works with around the world.

Reports indicate the UN hid the incident, which reportedly began in July 2019 and was noticed a month later. Employees were alerted to change their passwords but not notified of a breach, even though staff records, health insurance, and commercial contract data were compromised in the incident. Attackers were able to infiltrate pieces of IT infrastructure, including system controls, user and password management tools, and firewalls.

The attackers reportedly gained access via CVE-2019-0604, a known remote code execution vulnerability in Microsoft SharePoint that was disclosed in February 2019. Since a patch was released, security researchers have seen the bug exploited in active attacks. In May 2019, both the Saudi Arabia National Cyber Security Center and Canadian Cyber Security Centre reported attackers were using the China Chopper web shell to gain initial access and exploit this flaw.

This vulnerability gave intruders the access they needed to move throughout UN networks. So far, the attackers have not been identified, though it's believed they are sophisticated threat actors.

Read more details here. 

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "7 Steps to IoT Security in 2020."