Last week, some of Microsoft’s apps were knocked offline in an intentional cyber-attack, it said in an update. The company’s attempts to stop the hack amplified it. That meant that some of its apps and features were offline for much of 31 July. It came just days after Windows PCs were hit by a huge outage that brought much of the world to a standstill, cancelling flights and delaying hospital appointments. That was the result of a bug in cybersecurity software made by third-party company CrowdStrike and was not an intentional cyber-attack.[1]
Microsoft said initial problems last week on its Azure cloud platform had been triggered by a distributed denial-of-service (DDoS) attack, where bad actors tried and knocked a platform offline by flooding it with traffic until it could no longer operate. The issue has been resolved, Microsoft said, but the company confirmed its initial investigations had found that an error in the rollout of its own defenses to prevent the attack “amplified the impact of the attack rather than mitigating it.”
In an update posted to its Azure status website, Microsoft said an “unexpected usage spike” had caused performance issues on parts of its Azure platform, for which the company said the “initial trigger event” had been the DDoS attack that “activated our DDoS protection mechanisms”, but these protections had initially made things worse, before the firm made “network configuration changes” to relieve and eventually help solve the issue.
CrowdStrike: https://redskyalliance.org/xindustry/fixing-the-blue-screen-of-death
The incident last week saw thousands of users report issues accessing a range of Microsoft services, with service status website DownDetector reporting user-flagged issues with Microsoft Teams, Xbox Live and other services. Other websites were also affected, with banking giant NatWest apologizing to customers whom it said had been unable to access some of its webpages, while Oxford United Football Club posted to X to confirm the issue was preventing online members from accessing online ticketing and club shop services.
The incident came less than two weeks after a major IT outage knocked global infrastructure including transport and healthcare services offline because a flawed software update from cybersecurity firm CrowdStrike affected Microsoft devices.
A senior cybersecurity consultant at Cybersmart, said: “It’s not unsurprising to see that Microsoft has been subject to a denial-of-service attack, I imagine this is a frequent event for them. What is surprising is that it was successful. Microsoft have confirmed they do have DDoS protection in place which is what we would expect, however the protection they did have in place was misconfigured which in fact ended up amplifying the attack. This has been fixed and Microsoft have said they will be publishing an incident review within 72 hours sharing greater detail on what has happened. The fact this misconfiguration happened and was in effect exploited is concerning and understanding how Microsoft allowed this to happen will be crucial in ensuring if businesses can maintain confidence in them.
“For those affected they lost access to some of their Microsoft services for up to 10 hours. This is now the second reminder in two weeks of the importance of having business continuity planning in place. Whether a specific piece of software is unavailable or your entire network becomes unusable, you must have plans in place to ensure that your business can continue to work. It’s also a reminder of the reliance we have on big organizations. This may have impacted people indirectly whereby their supply chain was unable to fulfil demands placed on them. This in turn could be costly to business or simply damage business relationships. If businesses are to take one learning point from the past two weeks, it should be to have an incident response procedure in place, supported by a business continuity plan and test them. Ensuring that procedures work and that key stakeholders are able to execute them efficiently.”
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information via a notification service (RedXray) or an analysis service (CTAC).
For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5378972949933166424
[1] https://news.yahoo.com/news/microsoft-down-outage-caused-cyber-162027273.html/
Comments