Microsoft on Saturday issued an alert about “active attacks” on self-hosted SharePoint servers

International News via Reuters:

A sweeping cyber espionage operation targeting Microsoft server software compromised about 100 different organizations as of the weekend, two of the organizations that helped uncover the campaign said on Monday.

Microsoft on Saturday issued an alert about “active attacks” on self-hosted SharePoint servers, which are widely used by organizations to share documents and collaborate within organisations. SharePoint instances run off of Microsoft servers were unaffected.

Dubbed a “zero-day” because it leverages a previously undisclosed digital weakness, the hacks allow spies to penetrate vulnerable servers and potentially drop a backdoor to secure continuous access to victim organizations.

Vaisha Bernard, the chief hacker at Eye Security, a Netherlands-based cybersecurity firm, which discovered the hacking campaign targeting one of its clients on Friday, said that an internet scan carried out with the Shadowserver Foundation had uncovered nearly 100 victims altogether – and that was before the technique behind the hack was widely known.

“It’s unambiguous,” Bernard said. “Who knows what other adversaries have done since to place other backdoors.”

He declined to identify the affected organizations, saying that the relevant national authorities had been notified.

The Shadowserver Foundation confirmed the 100 figure and said that most of those affected were in the United States and Germany and that the victims included government organizations.

Another researcher said that, so far, the spying appeared to be the work of a single hacker or set of hackers.    

“It’s possible that this will quickly change,” said Rafe Pilling, director of Threat Intelligence at Sophos, a British cybersecurity firm.

Microsoft said it had “provided security updates and encourages customers to install them,” a company spokesperson said in an emailed statement.

It was not clear who was behind the ongoing hack. The FBI said on Sunday it was aware of the attacks and was working closely with its federal and private-sector partners, but offered no other details. Britain’s National Cyber Security Center said in a statement that it was aware of “a limited number” of targets in the United Kingdom. A researcher tracking the campaign said that the campaign appeared initially aimed at a narrow set of government-related organizations.

The pool of potential targets remains vast. According to data from Shodan, a search engine that helps to identify internet-linked equipment, over 8,000 servers online could theoretically have already been compromised by hackers.

Those servers include major industrial firms, banks, auditors, healthcare companies, and several U.S. state-level and international government entities. 

“The SharePoint incident appears to have created a broad level of compromise across a range of servers globally,” said Daniel Card of British cybersecurity consultancy, PwnDefend. 

“Taking an assumed breach approach is wise, and it’s also important to understand that just applying the patch isn’t all that is required here.”

Reporting by James Pearson and Raphael Satter, Editing by Nick Zieminski and Marguerita Choy

A government source said examinations of the plane’s recovered engines found that no defects had been present before the bird strike and crash

International News via Reuters:

The South Korea-led investigation into Jeju Air’s fatal plane crash in December has “clear evidence” that pilots shut off the less-damaged engine after a bird strike, a source with knowledge of the probe said on Monday.

The source said the evidence, including the cockpit voice recorder, computer data and a physical engine switch found in the wreckage showed pilots shut off the left engine instead of the right engine when taking emergency steps after a bird strike just before it was scheduled to land.

“The investigation team has clear evidence and backup data, so its finding will not change,” the source told Reuters on condition of anonymity because investigators have not released an official report including this evidence.

A government source said examinations of the plane’s recovered engines found that no defects had been present before the bird strike and crash.

The December 29 crash of the Boeing 737-800 jet at Muan Airport killed all but two of the 181 passengers and crew members on board and was the deadliest air disaster on South Korean soil.

Investigators told victims’ family members at a briefing on Saturday that the right engine had been more severely damaged by a bird strike than the left, and there was circumstantial evidence that pilots had turned off the less-damaged left engine, according to a third source who was at the briefing.

South Korean media outlets including MBN and Yonhap reported that information on Saturday and Sunday.

South Korea’s Aviation and Railway Accident Investigation Board (ARAIB), which is leading the investigation, did not respond immediately to a request for comment.

Boeing referred questions about the crash to ARAIB. Engine maker CFM International, a joint venture between GE and France’s Safran, did not immediately respond to a request for comment.

Jeju Air said it was actively cooperating with the ARAIB’s investigation and awaiting the official announcement of the results.

Most air crashes are caused by multiple factors, and under international rules, a final report is expected within a year of an accident.

A preliminary report released in January said duck remains were found in both engines of the Jeju Air plane after the flight from Bangkok crashed at Muan Airport, but did not give details about the extent of remains or damage found in each engine.

OBJECTIONS FROM VICTIMS’ FAMILIES

South Korea’s investigation body on Saturday cancelled a planned release to media of an update on what is known so far about the engines.

Families of the crash victims were briefed on the report ahead of its planned release, but objected to its publication, saying that it appeared to apportion blame to the pilots without exploring other contributing factors, lawyers representing the families said.

The Jeju Air flight overshot Muan Airport’s runway as it made an emergency belly landing and crashed into an embankment containing navigation equipment, leading to a fire and partial explosion.

Representatives of victims’ families and the Jeju Air pilots’ union said over the weekend that the investigation needs to also focus on the embankment, which aviation experts have said likely contributed to the high death toll.

The Jeju Air pilots’ union said the ARAIB was “misleading the public” by suggesting there was no problem with the left engine given traces of bird remains were found in both engines.

The union accused the ARAIB of trying to make pilots “scapegoats” by failing to provide scientific and technological grounds that the plane could have landed safely with only the left engine turned on.

Air accidents are complex incidents that occur due to a number of contributing factors, and investigators have not produced evidence so far to support the implication that the accident was a result of pilot error, the union said.

Investigators are so far “silent about organisational responsibility”, the union said.

A body representing bereaved families said in a statement there were some phrases related to the cause of the accident in the planned press release that could be interpreted as if a final conclusion had been reached, and all facts surrounding the incident must be clarified.

Reporting by Hyunjoo Jin and Lisa Barrington; Additional reporting by Joyce Lee; Editing by Jamie Freed