ConnectWise Suspends Cloud Services Following Unauthorized Access Incident
ConnectWise, a prominent provider of IT management software, has taken a significant step in response to a troubling security breach impacting its cloud services. The company recently suspended access to various cloud services after uncovering that unauthorized actors had infiltrated multiple Microsoft 365 tenants. This move aims to safeguard customer data and investigate the extent of the breach.
Understanding Microsoft 365 Tenants
A Microsoft 365 tenant serves as a unique instance of Microsoft services for organizations, enabling them to manage and store data securely and separately from other users. Each tenant is assigned a distinct identifier to ensure that an organization’s data remains private and protected. Any compromise of these tenants poses substantial risk, particularly when it involves sensitive organizational data.
Timeline of Events
The incident first came to light on October 15, when ConnectWise noticed some suspicious activity within its ecosystem. By October 17, the investigation revealed that there had been "unauthorized access to application identities" within the ConnectWise Cloud Backup environment, which necessitated immediate action. As a precaution, the company temporarily disabled several cloud services, notably Cloud Backup (previously known as SkyKick), along with SaaS Security and Cloud Management.
In an update released on October 19, ConnectWise acknowledged the interruptions’ impact on its partners’ ability to support their customers. The company stated, "We do not yet have a confirmed restoration time and will share a timeline as soon as we can do so reliably."
Implications of Unauthorized Access
The unauthorized access identified is concerning due to the potential for attackers to misuse it. There is a risk that such access could enable intruders to authenticate themselves in the same manner as legitimate backup services, leveraging existing permissions to gain entry into customers’ Microsoft 365 environments. This could lead to unauthorized access to critical directories and sensitive data, putting corporate data at serious risk.
Justin Kohler, the Chief Product Officer at SpecterOps, shed light on the situation, explaining, "The credentials belong to the application itself, so the attacker inherited the permissions granted to it. Multi-factor authentication (MFA) doesn’t apply because this is an application sign-in, so no user, device, or MFA prompt is involved." This highlights the vulnerability inherent in backup tools, which typically require extensive permissions to read and restore data.
Cybersecurity Expert Insights
Cybersecurity analysts from Huntress have been closely monitoring the ongoing ConnectWise situation. In a detailed blog post, they shared insights indicating that in at least one tenant observed, the attacker had assigned themselves a Global Administrator role. This allowed the individual to alter permissions for other applications, including both a managed service provider (MSP) management tool and Huntress’s own security application.
While ConnectWise has stated it has not yet found evidence suggesting that partner backup data has been compromised, the company has committed to ongoing investigations into potential unauthorized access. “We cannot discuss threat actor attribution at this time. Our focus is on investigation, remediation, and supporting affected partners and their customers,” a representative stated in their advisory.
Recommended Actions for Customers
In light of these events, ConnectWise has urged its customers to implement several precautionary measures to identify any potential incidents. The recommendations include:
-
Verify Application Connections: Customers should check the status of all listed application connections, keeping affected applications disabled until further instructions are provided by ConnectWise.
-
Preserve Records: It’s essential to promptly preserve available sign-in and audit records while taking any immediate containment actions necessary to mitigate risks.
-
Review Authentication and Roles: Users should scrutinize application and user authentication processes, application credentials, directory roles, and any recent policy changes that could point to suspicious activity.
-
Monitor Mailbox Settings: Customers are encouraged to check for unauthorized mailbox forwarding, inbox or transport rules, and delegated access that may have been established without consent.
- Investigate Alterations: It’s important to explore any other identities that may have been changed or used during periods of suspicious activity, as disabling the original applications does not necessarily eliminate alternative access points.
Conclusion
The ongoing investigation by ConnectWise signifies the critical importance of cybersecurity measures in protecting sensitive organizational data. While no definitive timeline has been established for when affected cloud services will be restored, the company’s proactive measures are focused on ensuring the safety of its partners and their customers. As the digital landscape continues to evolve, organizations are reminded to remain vigilant in safeguarding their systems against unauthorized access and potential breaches.