Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

At work we use Outlook 2010 (I think) and an exchange server.

The situation is simple: Our IT Manager (Steve) was fixing a problem one of the guys out in the field (Dave) was having with email on his phone.

The Steve did not put his own email on the phone but worked with Dave's email.

A few hours later we find out that Dave got ahold of some of Steve's emails and forwarded them to other members of the staff (both their work and personal emails).

Now my question is simply is it possible for there to have a been a glitch that accidentally sent Steve's emails to Dave's phone or would Dave have to purpose hack/put it on himself?

share|improve this question
add comment

2 Answers

Anything we can say at this point is purely speculation, but based upon the information provided, I suspect the most likely explanation is inadvertent error, not malicious hacking. Hacking is certainly possible, but it's not the first explanation I'd leap to.

For instance, maybe Steve inadvertently hooked up his email address to Dave's phone, or maybe Steve inadvertently typed his email password into Dave's phone while testing and the phone helpfully remembered it, or maybe there was some configuration error in setting up Dave's email on the Outlook server.

I definitely would not accuse Dave of hacking Steve's email based just upon the information provided here. I would accuse Dave of poor judgement and poor ethics in forwarding Steve's emails to others and continuing to access Steve's email once Dave saw that he had access to Steve's email.


Update: Here are some additional suggestions on steps you could take to try to assess fault.

First, contact HR (and Security, if you have a Security department) immediately. They should run the show.

Then, I would suggest you secure any logs from the Outlook Exchange you have, and analyzing them.

Third, I recommend that someone interview Dave and Steve to get their story. For instance, I'd try to nail down the exact timing. If Exchange keeps logs of when the email was accessed, you could then compare the timing and their stories against the timestamps in the Exchange logs. I'd also ask Dave what he did to his phone and how he accessed Steve's emails. I would ask Steve whether there is any chance that he might have entered his password into Dave's phone, even temporarily. I'd also interview Steve to see if he made any configuration changes to Exchange that might have given Dave access to his email. And, I'd try to assess whether Steve has any motive to try to spin things or not (mutual dislike? bad blood?). You probably want to have someone else (HR?) doing the interviewing.

Fourth, I recommend that you confiscate Dave's phone for examination without further delay. If it was a mistake, either Dave's phone may still have access to Steve's email, or Dave may be able to give some story about what happened that might explain why his phone no longer has access to Steve's email.

After you have assessed all the information available to you, if you're still not sure what happened, you could always consider trying an old interviewer's trick. Have HR sit Dave down and say "Look, Dave, this is a very serious situation. We confiscated your phone, we analyzed the logs on your phone and on the Exchange server, and we know just about everything about what happened. The only thing we don't know is whether your actions were premeditated, or whether they were a spur-of-the-moment instance of poor judgement. If your actions were premeditated, this a severe offense, and I may be forced to fire you. On the other hand, if it was not pre-meditated, then that's still not good, but at least it would give me a basis for arguing on your behalf with the CEO. So, if it was not premeditated, and if you are prepared to write out a full and complete confession right now and express remorse, I am prepared to argue for leniency in your case. But don't try and snow me: if your confession differs in even one iota from the log information we already have, deal's off, and I'm going to be pissed. So, what do you say, Dave?" No guarantees that it'll work, though.

share|improve this answer
    
I appreciate all the comments thus far. The main purpose for my seeking understand as to possible things that might have happened is we are trying to determine if it's a fireable offense or not. They tend to be fairly lenient around here so the forwarding probably not, but if he did purposely get into Steve's email then yes. If there is any information that would help determine how it happened ie a log on Dave's phone or something please let me know. When it comes to phone tech I fail. I know very little about it. –  Orchid Apr 17 '12 at 21:03
add comment

There are only 2 ways that I can think of at the moment to do this.

(Hopefully I get the names right, but the concepts still remain the same)

  1. Dave configured his phone to receive Steve's emails

  2. Dave setup a forward (but keep copies in both inboxes) from Steve's email address to his own.

A simple way to know how it's configured is who did the email originate from that was being sent from?

If it came from Dave's email address then he setup a forward.

If it came from Steve's email address and Dave sent it, it came from Dave setting up Steve's email account on his phone.

Now to clarify something. I would not call it hacking if he configured his co-workers email on his phone unless he actually hacked the account (Steve may have given him his password at some point in time).

If Steve's password is StEvE123 and all passwords reflect this type of password then he guessed the password correctly and it was not hacked. It would be a neglagent password policy that is at fault.

If he sniffed traffic or cracked/bruteforced the password then you enter the territory of hacking; anything else is not.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.