New Attack Targeting Microsoft Outlook Web App (OWA) to Steal Email Passwords

Researchers have unearthed a risky backdoor in Microsoft's Outlook net application (OWA) that has allowed hackers to steal e mail authentication credentials from foremost corporations.

The Microsoft Outlook internet software or OWA is a web-dealing with webmail server this is being deployed in private groups and companies to offer internal emailing capabilities.

Researchers from security seller Cybereason located a suspicious DLL document loaded into the organization's OWA server that siphoned decrypted HTTPS server requests.

Although the file had the same call as any other benign DLL file, the suspicious DLL document turned into unsigned and loaded from any other directory.

Hackers positioned Malicious DLL on OWA Server

in line with the safety firm, the attacker changed the OWAAUTH.Dll file (used by OWA as part of the authentication mechanism) with one that contained a dangerous backdoor.

Since it ran on the OWA server, the backdoored DLL file allowed hackers to acquire all HTTPS-protected server requests, which include login statistics once they were decrypted, i.E., in clean textual content.

"OWA became configured in [such] a manner that [it] allowed internet-facing access to the server,"Cybereason wrote in a publish posted Monday. "This enabled the hackers to set up continual manipulate over the whole agency's surroundings with out being detected for several months."

Hackers Stole 11,000 Credentials

each consumer getting access to the hacked server had their username & password compromised and saved by the attackers.

Researchers observed extra than 11,000 usernames and passwords combinations in a log.Txt record inside the server's "C:" partition. Log.Txt document is thought to be used by attackers to save all logged records.

The unnamed corporation that detected "behavioural abnormalities" throughout its community earlier than achieving out to security firm Cybereason had greater than 19,000 endpoints.

To save you their backdoor from being eliminated, the attackers additionally created an IIS (Microsoft's web server) filter out thru which they loaded the malicious OWAAUTH.Dll file each time the server was restarted.

To add icing to the cake — the advanced chronic attackers utilized a .Internet meeting cache for you to keep away from auditing and safety inspection.

The security firm did now not say how good sized this assault is past it focused on one enterprise, but there are chances that the assault is or can be hitting other big organizations as nicely.