Page 176 - https://downmagaz.net

Exim is so widely used — though far less known

than such commercial alternatives as Microsoft’s

proprietary Exchange — that some companies

and government agencies that run it may still

not have patched the vulnerability, said Jake

Williams, president of Rendition Infosec and a

former U.S. government hacker.

It took Williams about a minute of online

probing to find a potentially vulnerable

government server in the U.K.

He speculated that the NSA might have issued

to advisory to publicize the IP addresses and

a domain name used by the Russian military

group, known as Sandworm, in its hacking

campaign — in hopes of thwarting their use for

other means.

The Exim exploit allows an attacker to gain

access using specially crafted email and

install programs, modify data and create

new accounts — gaining a foothold on a

compromised network.

The NSA did not say who the Russian military

hackers have targeted. But senior U.S.

intelligence officials have warned in recent

months that Kremlin agents are engaged in

activities that could threaten the integrity of the

November presidential election.

An NSA official reached by The Associated Press

would only say that the agency is publicizing

the vulnerability because, despite an October

warning by British officials, it “has continued

to be exploited and needs to be patched.”

The hope, in now publicizing Sandworm’s

role, is to further motivate patching, said the

official, who spoke on condition they not be

further identified.

176