Friday, March 29, 2024

baseStriker – 100 Million Email Users are Vulnerable Critical Office 365 Zero-day Flaw

A new security flaw uncovered in Office 365 dubbed baseStriker puts 100 Million Email Users at risk. With this vulnerability, attackers can bypass all the Microsoft security services including its advanced services like ATP, Safelinks, etc.

The traditional HTML email with malicious link would be blocked by Microsoft security, but hackers could bypass their security by splitting them into two snippets of HTML: a base tag and a regular href tag.

Security researchers from Avanan identified the critical vulnerability in Microsoft Office 365 email service on 5/1/2018. The name baseStriker indicates the method used by hackers used to leverage the vulnerability.

https://youtu.be/rOmFuC4rLJY

How the baseStriker attack works

The normal phishing email would be blocked when they looked up against the know badlinks and with the premium services like ATP replaces the links into safelinks.

Normally, a malicious <a href="https://bit.do/ee9mr"?link</a> is blocked

By using baseStriker method attackers can present the same link to the user bypassing the email filters as they are not handling the <base> HTML code correctly.

baseStriker

Attackers split the URL into two snippets of HTML: a base tag and a regular href tag. office 365 scan only the URL in the base domain and ignores later part of the domain that presents in the rest of the body.

Also Read Microsoft Added Ransomware Protection, Recovery & Email Encryption For Office 365 Users

According to Avanan researchers “we have only seen hackers using this vulnerability to send phishing attacks, but it is also capable of distributing ransomware, malware and other malicious content”.

Are you Vulnerable to baseStriker

They have tested the vulnerability with various environments, according to researchers “anyone using Office 365 in any configuration is vulnerable”. Gmail users are not vulnerable.

I am using: Am I Vulnerable to baseStriker?
Office 365 Yes – you are vulnerable
Office 365 with ATP and Safelinks Yes – you are vulnerable
Office 365 with Proofpoint MTA Yes – you are vulnerable
Office 365 with Mimecast MTA No – you are safe
Gmail No – you are safe
Gmail with Proofpoint MTA We are still in testing and will be updated soon
Gmail with Mimecast MTA No – you are safe
Other configurations not here? Contact us if you want us to help you test it

Mitigations

Hackers abusing this vulnerability in wide to launch phishing attacks and still there is no fix for this vulnerability.

It is recommended to have two-factor authentication enabled to avoid account take over.

Avanan reported the vulnerability on 5/2/2018 and Microsoft not yet commented about when the patches to be released addressing this vulnerability.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles