ConnectWise, LLC

I hope to give you the news and the update, but we expect to see a lot of information flowing from that as it gets towards the end of the year, and Microsoft wants to bring some of its recent changes to Copilot to the fore.

Now, it's been a big week in security for people in SMB, typically with the ConnectWise and Skykick issues, plus PHP challenges around websites.

So Not unexpectedly, we've got lots of information flowing around that.

I'll give you kind of a sample here that I would suggest you go and have a look at.

So Microsoft has an article here on AI-driven large-scale nation-state campaign using RTX-enabled supply chain compromises.

This is really all about the ConnectWise issue in there.

So if you want to read all the information from Microsoft directly, that is in there.

I also have a blog post here that I produced.

We're going to do the question of the week.

The ConnectWise backup breach is, of course, the heavy news that's out there.

Mm-hmm.

You might have noticed MapQuest got a new lease on life.

Book a demo at Oveka.io slash MSP Radio.

That's O-V-E-K-A dot I-O slash MSP Radio.

Well, we have to talk about the ConnectWise security issue that just happened.

So ConnectWise bought Skykick a few years ago, and that became ConnectWise Backup.

You need to know what good looks like before you can ever, ever hunt for bad.

And over the weekend, we've seen something come out from ConnectWise, right? Where their cloud backup, formerly known as Skykick service, had a massive interruption.

There was a bunch of vulnerabilities going on around it.

Now, back in my day, because I'm old, sonny, you know, Skykick was an application that some folks used to do data migrations to with a third-party tool from on-premise Exchange servers and Rackspace servers and all that to pull everything into the Microsoft 365 tenancy.

So, you know, if you are using Skykick for your 365 cloud backup Definitely pause, come back to this thing later.

The link is in the description down below as the first one.

But yeah, if you're watching on screen, you got the ConnectWise cloud backup, the cloud management, which I guess is almost like a competitor.

I did not know about this, a lot of these tools.

Morning edition.

ConnectWise's backup app held a master key to Microsoft 365 tenants.

A backup tool has turned out to be a master key to Microsoft 365.

ConnectWise has suspended its cloud backup service, formerly Skykick, after attackers signed in to customer tenants, each organization's own slice of Microsoft 365 as the product's own application.

ConnectWise's advisory says it can't tell from its own systems which tenants were affected, and it offers no restoration time.

So, how does one backup product open so many doors? Picture a locksmith who cuts a single master key for every client building, so a backup contractor can let itself in.

It's a multi-tenant product, so one credential held by ConnectWise works in every tenant that has granted consent.

Todal, a security firm investigating, says an attacker holding that credential used OAuth the standard that lets one app act for you inside another, to collect tokens for each tenant.