{
  "timestamp": "2025-02-05T22:52:36.284486",
  "content": "Search Free Trial Get Demo Attack Exploits Vulnerability in Half of Email MTAs Globally June 14, 2019 Attacks predicted for a freshly reported email server vulnerability have come true in less than a week. If youre an email administrator, you should be aware of the attacks this week targeting a vulnerability in the Exim MTA server code versions 4.87 to 4.91, the objective of which is to create a backdoor that could then be exploited for almost anything, since with the backdoor in place, the attackers would then have full root access on the server. Attack exploits vulnerability reported just last week Some details of this attack including some of Cyrens analysis can be found in reporting published yesterday here also German and French reporting today. The attack leverages a vulnerability found and published only last week by researchers at Qualys, described as CVE-2019-10149, as reported in ZDNet . According to the article, over half of all email servers visible on the internet run Exim. The Qualys researchers last week said they hadnt seen anyone trying to exploit it, but they expected to see such soonso it looks like they were correct. The vulnerability is being referred to as The Return of the WIZard, in reference to a similar vulnerability in Sendmail in the 1990s, which led to the WIZ attacks. With respect to who might be behind the attack, the malicious script is hosted in the Tor network, so attribution is almost impossible. They are targeting Red Hat Enterprise Linux RHEL, Debian, openSUSE and Alpine Linux operating systems The hackers would most likely get access to all of a companys email, and, depending on their goals, they might add the server to a botnet, or try to use that server to infiltrate the rest of a companys servers and then exfiltrate data. How the attack works Cyren analyzed a sample and discovered that the immediate objective of the current attack is to create a backdoor into the MTA servers by downloading a shell script that adds an SSH key to the root account. The steps being followed are The attackers send an email or just initiate a connectiontechnically, they only need to reach the step where the MTA asks for the recipients of the emailand in the SMTP dialog of that email the RCPT_TO field gets an email address that contains a localpart specially crafted by the attackers that exploits the Exim vulnerability. Specifically, the attack uses a RCPT_TO that looks like the below, which downloads a Shell script and directly executes it The infected Exim version then executes that localpart in its own user context, and Since people are still running Exim as root, it will then download a shell script that will open SSH access to the MTA server via a public key to the root user Well update this blog with any new information as this attack develops. Want to learn more about cloud-based email security? Contact us here! Try it for Free Instant Data Classification Cyren URL Category Chacker Prev A view from the exhibition floor three takeaways from Infosecurity Europe 6 Phishing Techniques Driving Phishing-as-a-Service Operations Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_type": "comprehensive",
  "analysis": "**Comprehensive Analysis of Exim MTA Vulnerability and Security Measures**\n\n**1. Key Security Features and Their Benefits to Users:**\n   - **Patching and Update Management:** Regularly updating software is crucial. Exim versions 4.87 to 4.91 are vulnerable, so updating to the latest version (4.92 or higher) is essential to prevent exploitation of CVE-2019-10149.\n   - **Access Control and Least Privilege:** Running services with minimal privileges reduces the impact of breaches. Ensuring Exim doesn't run as root limits the damage if compromised.\n\n**2. Compliance Certifications and Regulatory Adherence:**\n   - **GDPR Compliance:** Protecting email servers is vital for compliance with GDPR, as breaches can lead to data exfiltration and significant fines.\n   - **Data Protection Regulations:** Adhering to standards like ISO/IEC 27001 ensures robust data security practices, mitigating the risk of non-compliance.\n\n**3. User-Focused Security Recommendations:**\n   - **Immediate Actions:** Apply patches immediately to vulnerable Exim versions and avoid running services as root.\n   - **Network Security:** Use firewalls to restrict access to email servers and monitor for unusual traffic.\n   - **Backup and Recovery:** Regular backups allow quick recovery in case of an attack.\n\n**4. Technical Security Implementation Details:**\n   - **Exploit Mechanism:** The attack uses a crafted RCPT_TO field to trigger the vulnerability, leading to a backdoor via shell script execution.\n   - **Mitigation Steps:** Upgrade Exim, disable unnecessary features like VRFY, and use security patches from Linux distributions.\n\n**5. Data Protection Measures:**\n   - **Encryption:** Use TLS for email communications to protect data in transit.\n   - **Access Controls:** Limit access to critical systems and regularly audit configurations to ensure security.\n\n**6. Best Practices for End Users:**\n   - **Phishing Awareness:** Educate users to recognize suspicious emails that might be part of social engineering attacks.\n   - **Regular Monitoring:** Implement intrusion detection systems and log analysis to quickly identify and respond to breaches.\n   - **Security Hygiene:** Maintain updates, use strong passwords, and implement multi-factor authentication where possible.\n\n**Conclusion:**\nThe Exim MTA vulnerability underscores the importance of a proactive security strategy. By focusing on patching, secure configurations, and user education, organizations can significantly reduce the risk of such attacks. Integrating these practices into a broader security framework ensures comprehensive protection against evolving threats."
}