Keynote: An Unauthorized Exchange - From Targeted Espionage to the Global Cyber Pandemic

on YouTube ↗01h 09m

" summary

Describes how Exchange zero-days chain an SSRF into remote code execution (the so-called proxy logon sequence), letting attackers trivially siphon mail — one victim shows ~1 GB leaving in minutes — then drop web shells (China Chopper, a Sportsball variant) for persistence. Team reproduces the exploit with a proof script called marauder, captures attacker HTTP payloads via a proxy shim, uses memory forensics and TLS downgrade to decrypt traffic, and documents widespread compromise (tens of thousands to hundreds of thousands of servers; FBI later removes many web shells).

AI-written summary · about

" chapters (39)

1. 0:00Start
2. 1:43Company Background
3. 3:19Agenda
4. 4:00Quick Overview
5. 6:34How It Started
6. 8:21First Stop: IIS Logs
7. 10:03Unexplained Results
8. 11:27Server Compromise?
9. 13:30Second Victim...
10. 16:31Executing the Game Plan
11. 18:05Web Logs Tell a Useful Story
12. 19:16Proxy Shim for the Win Headers
13. 19:37Proxy Shim for the Win - SOAP Request
14. 20:21What Have We Found?
15. 22:22The Nearly Perfect Crime
16. 24:00Marauder
17. 24:39Reporting to Microsoft
18. 26:54SSRF to RCE
19. 28:50Figuring Out CVE-2021-27065
20. 30:42Decrypted Network Traffic
21. 31:23Traffic Examination
22. 33:45More Victims
23. 34:45Intrusions
24. 36:22Just the Beginning
25. 36:51A Patch of Hope
26. 38:40Not Quite Fast Enough
27. 40:08Exchange Admins on Tuesday Evening
28. 40:28Staggering Numbers
29. 40:55Investigating Exchange Servers
30. 42:16System Memory
31. 48:33Exchange Logs (Non-IIS) - HttpProxy ECP
32. 48:54Master File Table
33. 49:47Files from Web Directories
34. 50:20Event Logs
35. 52:02What Has Volexity Seen?
36. 54:24Offline Address Book (OAB)
37. 55:14FBI Webshell Removal
38. 56:36Closing
39. 57:51Resources

" related talks

• 43mHunting for Bugs, Catching DragonsNicolas Joly · Black Hat USA 2019
• 48mHacking Exposed: Next-Generation Tactics, Techniques, and ProceduresGeorge Kurtz, Michael Sentonas · RSA Conference 2023
• 45mKeynote Address: Click Here to Hack Your Target: A Perspective on the Past...Bill Marczak · 20th USENIX WOOT Conference on Offensive Technologies (WOOT '26)
• 40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern AttacksSnir Ben Shimol, Brian Vecci · RSAC 2021
• 25mGlobal Threat Brief: Hacks and Adversaries UnveiledDmitri Alperovitch, Sandra Joyce · RSAC Conference 2021
• 42mStart Covering Your Bases And Stop Chasing APT HeadlinesAvishay Zawoznik · Global AppSec Lisbon 2024
• 52mStart covering your bases & Stop chasing APT headlinesAvishay Zawoznik · NDC London 2025
• 40mHacker’s Paradise: Top 10 Biggest Threats When Working From HomePaula Januszkiewicz · RSAC 2021