News for hackers. Stuff that matters.

A comment on 30k U.S. organizations newly hacked via holes in Microsoft Exchange Server. Parent comment

Re:30k U.S. organizations newly hacked via holes in Microsof... by EvanAnderson on Friday March 05, 2021 @06:25PM (#26363600)
Exchange product architecture was absolutely to blame for this. Very particualrly, the "/ECP" directory should have never been allowed to be Internet accessible. (I believe the upcoming version finally rectifies that in a "supported" way.) In general, though, Microsoft hasn't focused enough on making Exchange more compartmentalized. The servers' privileges in Active Directory are too high (though this is supposedly being addressed in the upcoming version too.)
[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by kaliszad on Friday March 05, 2021 @10:34PM (#26364948)
Thank you for the insight.

Certainly, "in the upcoming version" is a bit late for those affected and most of those other Exchange-related hacks in the past. The thinking around Exchange is still more or less left in the 20th century and it shows.

[ Parent | on HN ]