back to article US National Security Council urges review of Exchange Servers in wake of Hafnium attack

The Biden administration has urged users of Microsoft's Exchange mail and messaging server to ensure they have not fallen victim to the recently-detected "Hafnium" attack on Exchange Server that Microsoft says originated in China. Microsoft revealed the attack last week and released Exchange security updates. The Biden …

  1. sev.monster Bronze badge
    IT Angle

    This is why I read el Reg. Reporting that matters. And I'm definitely not saying that because I've neglected to keep my own ear to the ground for issues like this.

    Well, guess it's time to check the ol' servers... on an unpaid weekend...

    The things I do for users.

    1. tip pc Silver badge

      Outsource it

      You could always just follow the crowd and outsource your email to a cloud like office or gsuite.

      Or just outsource the IT to one of the large outsource shops with hundreds of thousands of staff who work 24/7 365 and don’t complain about working weekends.

      I suspect non of the above would fix the exploit bit management would be seen to be doing something by logging a call.

      1. sev.monster Bronze badge

        Re: Outsource it

        Want to know the best part? We use 365 for email, and our on-prem Exchange server is merely a shim for the "haven't replaced it yet" and "old but necessary" sodftware that is too old to support Microsoft's requirement of TLS/1.2.

    2. sabroni Silver badge
      Facepalm

      re: guess it's time to check the ol' servers... on an unpaid weekend...

      Thanks for devaluing your own work and, by extension, the work of all of us.

      1. sev.monster Bronze badge

        Re: re: guess it's time to check the ol' servers... on an unpaid weekend...

        I do not devalue myself, my employer does.

        Alternatively: who hurt you?

        1. David Roberts Silver badge

          Re: re: guess it's time to check the ol' servers... on an unpaid weekend...

          Ummmm....point on the Exchange Server to where the man hurt you?

        2. sabroni Silver badge

          Re: I do not devalue myself, my employer does.

          And there's nothing you can do about it?

          Why don't you try standing up for yourself, don't you think your time has value?

          1. sev.monster Bronze badge

            Re: I do not devalue myself, my employer does.

            Can you not make assumptions about other people's situations? You think I don't value myself and my time? How offensive.

            I wasn't told I had to do it on the weekend by anyone, it could have waited until a work day. I chose to do it, for the users, as I said. Sometimes people do things for other peoplr because they want to.

  2. Anonymous Coward
    Anonymous Coward

    The Biden administration's CISA?

    Really? I think you'll find it was the orange one that wrote CISA into law in 2018 as a successor to the NPPD.

    Can't we have .co.uk back please!? Biden's done sweet FA apart from restarting the bombing of brown people.

    1. Anonymous Coward
      Anonymous Coward

      Re: The Biden administration's CISA?

      "Biden's done sweet FA apart from restarting the bombing of brown people."

      The bombing of brown people did not stop under trump but in fact may have increased:

      www.middleeasteye.net/news/trump-afghanistan-middle-east-strikes-civilian-deaths

      while at the same time, accountability decreased:

      foreignpolicy.com/2020/05/22/obama-drones-trump-killings-count/

    2. Anonymous Coward
      Anonymous Coward

      Re: the orange one that wrote CISA into law in 2018

      You know when you've been tango'd!

  3. vtcodger Silver badge

    "reports are suggesting the Biden administration will create a task force to address the Hafnium attack and its aftermath."

    I'm sure they will. And in 8 to 14 months we'll get a 470 page report that maybe 17 people will read. The basic problem -- which is that we don't seem to know how to build software that connects to public networks, does anything useful, and isn't vulnerable to attacks -- will not be solved.

    1. sev.monster Bronze badge

      And that report will be a rehashing of already-known information that IT admins 20+ years ago could have told you.

    2. Ken Moorhouse Silver badge

      RE: we don't seem to know how to build software that connects to public networks

      I think we do, it's just that Microsoft's approach is too monolithic and complex. Unfortunately "nobody got fired for buying Microsoft products" trickles right down to companies with a handful of employees and they install Exchange Server to handle their email. They struggle to configure it and leave it at the stage where it limps along, keeping their fingers crossed nothing goes awry.

      The following comment probably has these people in mind:-

      "Microsoft, meanwhile, has issued additional mitigation advice for those unable to patch Exchange Server."

      There is no mention in that mitigation of throwing in the towel and migrating to some kind of hosted solution, which in-house IT people now have the perfect excuse to recommend to their superiors.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2021