ACSC Initiative: Cyber Hygiene Improvement Programs (CHIPs) The ACSC’s Cyber Hygiene Improvement Programs (CHIPs) involve a series of cyber hygiene campaigns to improve the cyber security posture of Commonwealth, state, territory and local government entities. CHIPs also conduct high-priority operational tasking activities in response to identified and potential cyber threats or significant events. Through these activities, CHIPs can quickly build visibility of, and develop insights into, security vulnerabilities across Commonwealth, state, territory, and local governments, and guide urgent remediation work. In the 2020–21 financial year, 34 high-priority operational tasking activities were undertaken. This included scans of: ■ the remote access and working-from-home arrangements implemented by Commonwealth entities in response to the coronavirus pandemic ■ all Australian-attributed IP addresses to identify compromised on-premises Microsoft Exchange servers and Microsoft Windows Domain Controller Zerologon vulnerabilities (see Case Study: Widespread compromises via Microsoft Exchange server vulnerabilities, page 38) ■ all Commonwealth entities in response to the release of a mobile device management PoC exploit code. Case Study: Widespread compromises via Microsoft Exchange server vulnerabilities On 3 March 2021, Microsoft announced that it had detected multiple actors using zero-day vulnerabilities to compromise on-premises Microsoft Exchange servers in limited and targeted attacks. Microsoft issued a patch to assist vulnerable organisations; however, this would not remove any malicious actors already present on victim networks before the patch was applied. Following Microsoft’s patching advice, the ACSC observed malicious actors rapidly exploiting these vulnerabilities in unpatched Microsoft Exchange servers. The vulnerabilities in Microsoft Exchange servers effectively meant a malicious actor could access emails and other information or content stored on, or accessible by, that server. Once an actor exploited the vulnerability they could access email communications, take data and move further into a network. If organisations did not look for indicators of compromise, the vulnerability could lead to identity theft, unauthorised access to personal accounts and unlawful exfiltration of data, with the risk of extortion. On 19 July 2021, the Australian Government released a joint statement by the Australian Foreign Minister, Minister for Defence and Minister for Home Affairs joining international partners in expressing serious concerns about malicious cyber activities by China’s Ministry of State Security (MSS), and the Australian Government’s determination that China’s MSS exploited vulnerabilities in the Microsoft Exchange software affected thousands of computers and networks worldwide, including in Australia. Since 3 March 2021, the ACSC has worked closely with government and industry partners to identify vulnerable organisations and offer remediation advice. The ACSC published an alert on its website on 3 March 2021, updated several times since, and a technical advisory on 12 March 2021. The ACSC supported Microsoft in identifying and assisting vulnerable customers by using the ACSC’s CHIPs scanning activities. The Microsoft Exchange server experience – both in Australia and globally – reinforces the importance of remaining aware of the cyber security threat environment, and following ACSC advice. 38