Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [exchange]

Microsoft Exchange Server is a widely used email server that is used with all versions of Microsoft's Outlook, Entourage, IMAP, and POP3 clients. It is also used to host Microsoft's Office 365 cloud offering.

1
vote
1answer
35 views

Phishing/Spam using old MX record for direct sending which is circumventing Mimecast

We've been using Mimecast for email security for a few months now and there's been a dozen or so incidents where the phish/spam senders have utilized the old MX records to send directly to our Office ...
0
votes
1answer
108 views

Does NTLM authentication via HTTP not need a user name?

Because of a vulnerability that has been found in Exchange Server I was trying to run that attack on our local system to see if the workaround can successfully prevent it. I found a description of ...
0
votes
1answer
39 views

Automatically import/deploy/distribute private key to users for use with S/MIME

it is an Environment with Microsoft Active Directory, Exchange and Windows/Outlook as Client. Now there are the users which have their own private certificates to send signed mails and encrypt ...
0
votes
1answer
505 views

A replay attack was detected (4649) & Exchange Healthmailbox

We received alarms for this in our SIEM today. I believe it is expected and just "noise". The alarm was triggered immediately after Exchange cleared the ThrottlingConfig.log. I know Exchange Server ...
2
votes
2answers
216 views

Is it safe to add IP address to SPF record

I am a programmer who manages online exchanges user also and i have been asked to add IP address to SPF record so that one of the application can hosted on Azure can send emails to user etc.. v=spf1 +...
4
votes
1answer
39 views

Understanding Shake on IT key exchange

Shot paper I am reading a paper about key exchange and trying to understand the protocol described in Figure 4 on page 6 in the above paper. I understand the majority of the notation but am having a ...
0
votes
0answers
225 views

oAuth vs. Basic Authentication to connect to Azure AD backed services via Daemon/Service Application

I'm creating app that will run as an automated service with no user interaction to process to connect to a mailbox and process emails (download attachments, move emails to a "processed" folder, etc.). ...
1
vote
1answer
37 views

Email security between Outlook and Exchange 365 [duplicate]

From what I've understood by reading message headers and settings in Outlook, mails sent between Outlook on my PC and the Exchange cloud service are encrypted with TLS 1.2. Messages moving within the ...
1
vote
1answer
62 views

Outlook service is storing decrypted password in server memory – how insecure is it?

I am evaluating the possibility of using Outlook mobile client with an on-premise Exchange 2013 server. However it seems that the app sends quite a bit of data to Microsoft's cloud servers. It also ...
1
vote
1answer
345 views

Microsoft Exchange: Email and attachment encrypting

As per recent updates in UK data protection legislation I have been trying to find ways of encrypting all outbound emails from my server and was considering moving all our emails from a basic email ...
1
vote
1answer
80 views

Is using TSL/SSL for sending/receiving email the same as encrypting? [duplicate]

A client uses a big company for email control. A feature is encrypting, mainly, documents when they are sent(web portal based to access them). I was under the impression that sending an email out ...
1
vote
1answer
68 views

Third party exchange authentication

My organization has an in-house user authentication system shared between a very large number of internal systems. One of these systems needs to retrieve information from the logged in user's ...
1
vote
1answer
114 views

User mail certificates policy: Is expiration+renewal better than no-expiration+revocation?

In our environment, we provide user certificates to sign or encrypt emails. This is an internal setting, meaning the CA is internal to our organization (not a public CA) and handled by our Active ...
0
votes
1answer
508 views

How should I configure DMARC (or DKIM?) to deal with OWA forwarding changing email bodies?

For my own domain (mydomain.com, hosted with a free G Suite), I have setup DMARC in testing mode: v=DMARC1; p=none; sp=reject; aspf=s; adkim=s; rua=mailto:dmarc@mydomain.com I have sent out test ...
0
votes
1answer
189 views

Blocking Email Attachment download from outside company in Office 365

In Office 365, Emails can accessed from anywhere (within or outside of the company). Want to block Email attachment download from outside of the company. Emails should be accessible from outside of ...
3
votes
1answer
620 views

How to Audit an Email System

I am working on an auditing process for my company's email system (Exchange 2010). From this process, we're hoping to expand it out to other systems and start to clean up the rampant security issues ...
2
votes
3answers
599 views

forwarding company email to a contractor's email address

We use contractors from out of state and from other countries. An Active Directory account is created, which creates an Exchange email account. We forward email from the Exchange email address to a ...
3
votes
2answers
662 views

Bcc list of an exchange server email accessed by someone who was forwarded the email

An email was sent from our MS Exchange server and the addresses were listed in the bcc area. This email was forwarded to another person who was able to somehow extract the bcc list and email everyone ...
0
votes
1answer
309 views

Exchange Security - outgoing email marked as spam by recipients [closed]

Our company emails are getting blocked (blacklisted) every other day. Can someone tell us why the emails are getting blocked. And how to rectify for being blocked. Your advise will be highly ...
0
votes
1answer
41 views

Reason to Require A VPN Client for Exchange 2010 and Newer?

Reading Microsoft's Publishing Exchange Server 2010 with Forefront Unified Access Gateway 2010 and Forefront Threat Management Gateway 2010, it looks like encryption is baked in for client access in ...
3
votes
1answer
169 views

Storing NetworkCredential in SQL database

I have a web project where I need to store a username and password in an SQL database. the username/password are for exchange web services.(so it cannot be hashed, I need to be able retrieve a clear ...
4
votes
1answer
215 views

How much does TLS version matter when using the same cipher suite?

I recently observed that Exchange Online has switched to a lower version of TLS protocol. Emails from Exchange Online to Gmail and other Office 365 tenants are now sent over TLS 1.0 instead of TLS 1....
0
votes
0answers
215 views

Cain And Able successful attack- reveals exchange accounts

I conducted MiTM attack at one of our customers. the results showed that Cain was able to gather user credentials of some users, when they tried to connect to a remote exchange server (outlook....
1
vote
1answer
132 views

Is it possible to DNS-spoof Exchange ActiveSync?

My company's SSL Certificate for basically all their websites and Activesync servers have expired long ago. For my upcoming meeting's sake I need to explain how this is very insecure. Unfortunately I ...
1
vote
1answer
86 views

Rerouting emails to external account

There was a case when employee A thought he was getting legitimate emails from employee B, as the email address was valid, there were no CC/BCC addresses and just plain text in the body. Some ...
3
votes
3answers
4k views

Is sending email between different Office 365 domains (and organisations) secure?

Is sending emails between different Office 365 account owned by entirely separate entities secure? I.e. The email never leaves the Microsoft network? If the two are in the same data centre (E.g. ...
0
votes
3answers
608 views

DNS in DMZ or not and mail server architecture

I wonder what server I put in DMZ zone. I know the DMZ zone is for all servers or services who must be accessed from the internet, like Web Server, or mail server and sometimes DNS servers. But I ...
1
vote
1answer
118 views

MS Exchange email privacy and Admins

Using the Exchange control panel feature/tool of MS Exchange 2010, you can search all the emails belonging to any domain user and read them. Allowing an Exchange administrator to read the emails of ...
1
vote
2answers
85 views

Is it possible to protect the emails and calendar in an Exchange server against own Exchange administrators?

We have our Exchange server in a remote site administered by an external provider. We would like to avoid the possibility of provider employees to access the email and calendar of critical accounts in ...
5
votes
1answer
259 views

Should I have special emoticon handling for compliance, audit and logging?

I'm required to audit various communications (email, sms, messenger, social media) for keywords relating to financial data, HIPPA, and other PII. Is there any rational reason I should extend my ...
1
vote
1answer
71 views

Does a Mailbox Export Request modify the mailbox data?

The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest. What information is modified (if any) by the use ...
2
votes
1answer
60 views

Are there any examples of when personal email data can be brought into a lawsuit involving a corporation?

If users bring their own device (BYOD) and they have corporate Exchange (or Goodlink email) on that device, could the other email accounts on that device be open to a legal search? Would the SMS ...
0
votes
0answers
790 views

Exchange Autodiscover XML question (Exploit related)

Recently we had an issue with the Exchange autodiscover.xml appending ".com" to our mail servers autodiscover address. It resulted in a certificate error due to the name not matching the certificate. ...
3
votes
2answers
213 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore have ...
1
vote
0answers
751 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
1
vote
0answers
371 views

How should an ISP approach Mutual Auth TLS for SMTP email? (Domain Auth Email)

I'm looking for an easy to deploy way to make email clients (MUAs) display my email messages in a secure manner. PGP and SMIME both do this today, but they are high touch, and require software or ...
3
votes
1answer
214 views

Does PKCS #7 (CMS) add assurance to an email if a CRL/OCSP response is included, then revoked?

Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature. Then sometime in July I need to revoke that certificate. My ...
1
vote
0answers
158 views

Does Activesync certificate authentication replace a password, or act as 2 factor?

I am looking at Activesync authentication and want to know if Certificate Authentication ignores a client username and password or Certificate Authentication requires a username and password For ...
2
votes
0answers
113 views

Are old Android WebViews a risk to Activesync email, and how do I block old devices?

I'm concerned that old versions of Android may be hacked through unpatched WebViews (in PhoneGap and other apps), exposing Activesync email data, and other sensitive information. To mitigate this, ...
1
vote
2answers
5k views

Based on these email headers, where is this virus coming from?

I'm seeing a virus in our network with some strange headers. Sometimes they are coming (sourced) from a netscaler VIP, other times they seem to come from an Exchange hub server. How do I determine ...
2
votes
2answers
2k views

How can one secure Exchange 2010 cookies? [closed]

We have received the below finding from an IT audit. Missing Secure Attribute in Encrypted Session(SSL) Cookie: It is best business practice that any cookies that sent over (Set-cookie) an SSL ...
2
votes
2answers
937 views

OAuth Authorization flow and redirect

I started looking at OAuth - Google's and Facebook's implementation. Both of the implementations, in the authorisation flow, seem to send the "Authorization code" back to the web browser. I was ...
3
votes
2answers
213 views

What is the point of secure email gateways?

We run Exchange 2010. Our edge servers run "passive opportunistic TLS" for 99% of the domains we communicate with. For a handful of domains, we have forced TLS on both our end and the other domain's ...
5
votes
4answers
3k views

Exchange 2013 blocks txt file attachments - are there security reasons?

My Exchange Admin is setting up 2013, and it is set to block txt file attachments specifically (as well as others). I have tried searching for risks associated with txt attachments but could not ...
1
vote
1answer
896 views

How to prevent users from copying their outlook pst file to an external disk or system

We allow 4 gb space per employee in outlook mail exchange, beyond that the user has to create a pst file . That is the policy. We have given admin rights to all employees since there is a lot of ...
0
votes
2answers
468 views

When Activesync policy is applied to iPhones allows thumbprint-unlock, while Android does not. Which is correct?

We have a long-standing ActiveSync device policy that requires an unlock code for all phones that use corporate email. It seems that iPhones with "swipe to unlock" and Android phones with similar ...
1
vote
0answers
372 views

Securing MS Exchange [closed]

I have read quite a bit on the subject of securing MS Exchange - most notably the Client Access role. With the retirement of Microsoft's Threat Management Gateway many people seem to be looking for an ...
2
votes
1answer
4k views

How does Activesync security policy affect the usage of the iOS fingerprint scanner?

An Activesync IT administrator has the ability to choose if the phone should require a password, and also how complex it should be. Since the fingerprint scanner appears to replace the traditional ...
8
votes
2answers
3k views

Do any Exchange hardening guidelines recommend disabling OWA Webready? Should they?

For the fourth time in over a year, Exchange OWA has put our internal network at risk due to a remote code execution flaw that exists on the server runtime. This risk is compounded by the fact ...
14
votes
2answers
63k views

Is there an SSL / TLS Certificate state-cache on Windows, IE, and Outlook and how it it managed?

Today I changed the SSL certificate that 3,000+ Outlook clients are using. In doing this I changed the certificate to an "older" one that had the same subject name, expiration and everything else. ...