Questions tagged [exchange]

Microsoft Exchange Server is a widely used email server that is used with all versions of Microsoft's Outlook, Entourage, IMAP, and POP3 clients. It is also used to host Microsoft's Office 365 cloud offering.

Filter by
Sorted by
Tagged with
3
votes
2answers
188 views

Outlook rule to forward all emails - is that a common scam?

Recently we had a security problem. One email account which is based on MS Exchange 365 was hacked and the hacker forwarded all emails per rule to a Gmail account. I checked all relevant PCs and I ...
0
votes
0answers
37 views

Watch Encrypted IMAP Responses

I'm trying to see if I can decipher the messages coming back from Exchange when I try and login via secure IMAP. My office 365 accounts are under attack and I've disabled IMAP (and legacy login) but ...
0
votes
1answer
223 views

Does NTLM authentication via HTTP not need a user name?

Because of a vulnerability that has been found in Exchange Server I was trying to run that attack on our local system to see if the workaround can successfully prevent it. I found a description of ...
0
votes
1answer
59 views

Automatically import/deploy/distribute private key to users for use with S/MIME

it is an Environment with Microsoft Active Directory, Exchange and Windows/Outlook as Client. Now there are the users which have their own private certificates to send signed mails and encrypt ...
0
votes
1answer
844 views

A replay attack was detected (4649) & Exchange Healthmailbox

We received alarms for this in our SIEM today. I believe it is expected and just "noise". The alarm was triggered immediately after Exchange cleared the ThrottlingConfig.log. I know Exchange Server ...
1
vote
2answers
5k views

Based on these email headers, where is this virus coming from?

I'm seeing a virus in our network with some strange headers. Sometimes they are coming (sourced) from a netscaler VIP, other times they seem to come from an Exchange hub server. How do I determine ...
2
votes
2answers
307 views

Is it safe to add IP address to SPF record

I am a programmer who manages online exchanges user also and i have been asked to add IP address to SPF record so that one of the application can hosted on Azure can send emails to user etc.. v=spf1 +...
4
votes
1answer
41 views

Understanding Shake on IT key exchange

Shot paper I am reading a paper about key exchange and trying to understand the protocol described in Figure 4 on page 6 in the above paper. I understand the majority of the notation but am having a ...
1
vote
1answer
38 views

Email security between Outlook and Exchange 365 [duplicate]

From what I've understood by reading message headers and settings in Outlook, mails sent between Outlook on my PC and the Exchange cloud service are encrypted with TLS 1.2. Messages moving within the ...
1
vote
1answer
72 views

Outlook service is storing decrypted password in server memory – how insecure is it?

I am evaluating the possibility of using Outlook mobile client with an on-premise Exchange 2013 server. However it seems that the app sends quite a bit of data to Microsoft's cloud servers. It also ...
1
vote
1answer
422 views

Microsoft Exchange: Email and attachment encrypting

As per recent updates in UK data protection legislation I have been trying to find ways of encrypting all outbound emails from my server and was considering moving all our emails from a basic email ...
1
vote
1answer
86 views

Is using TSL/SSL for sending/receiving email the same as encrypting? [duplicate]

A client uses a big company for email control. A feature is encrypting, mainly, documents when they are sent(web portal based to access them). I was under the impression that sending an email out ...
1
vote
1answer
80 views

Third party exchange authentication

My organization has an in-house user authentication system shared between a very large number of internal systems. One of these systems needs to retrieve information from the logged in user's ...
1
vote
1answer
130 views

User mail certificates policy: Is expiration+renewal better than no-expiration+revocation?

In our environment, we provide user certificates to sign or encrypt emails. This is an internal setting, meaning the CA is internal to our organization (not a public CA) and handled by our Active ...
0
votes
1answer
572 views

How should I configure DMARC (or DKIM?) to deal with OWA forwarding changing email bodies?

For my own domain (mydomain.com, hosted with a free G Suite), I have setup DMARC in testing mode: v=DMARC1; p=none; sp=reject; aspf=s; adkim=s; rua=mailto:dmarc@mydomain.com I have sent out test ...
2
votes
3answers
672 views

forwarding company email to a contractor's email address

We use contractors from out of state and from other countries. An Active Directory account is created, which creates an Exchange email account. We forward email from the Exchange email address to a ...
3
votes
1answer
721 views

How to Audit an Email System

I am working on an auditing process for my company's email system (Exchange 2010). From this process, we're hoping to expand it out to other systems and start to clean up the rampant security issues ...
0
votes
1answer
228 views

Blocking Email Attachment download from outside company in Office 365

In Office 365, Emails can accessed from anywhere (within or outside of the company). Want to block Email attachment download from outside of the company. Emails should be accessible from outside of ...
3
votes
1answer
175 views

Storing NetworkCredential in SQL database

I have a web project where I need to store a username and password in an SQL database. the username/password are for exchange web services.(so it cannot be hashed, I need to be able retrieve a clear ...
3
votes
2answers
723 views

Bcc list of an exchange server email accessed by someone who was forwarded the email

An email was sent from our MS Exchange server and the addresses were listed in the bcc area. This email was forwarded to another person who was able to somehow extract the bcc list and email everyone ...
1
vote
1answer
136 views

Is it possible to DNS-spoof Exchange ActiveSync?

My company's SSL Certificate for basically all their websites and Activesync servers have expired long ago. For my upcoming meeting's sake I need to explain how this is very insecure. Unfortunately I ...
0
votes
1answer
344 views

Exchange Security - outgoing email marked as spam by recipients [closed]

Our company emails are getting blocked (blacklisted) every other day. Can someone tell us why the emails are getting blocked. And how to rectify for being blocked. Your advise will be highly ...
0
votes
1answer
41 views

Reason to Require A VPN Client for Exchange 2010 and Newer?

Reading Microsoft's Publishing Exchange Server 2010 with Forefront Unified Access Gateway 2010 and Forefront Threat Management Gateway 2010, it looks like encryption is baked in for client access in ...
0
votes
3answers
652 views

DNS in DMZ or not and mail server architecture

I wonder what server I put in DMZ zone. I know the DMZ zone is for all servers or services who must be accessed from the internet, like Web Server, or mail server and sometimes DNS servers. But I ...
4
votes
1answer
222 views

How much does TLS version matter when using the same cipher suite?

I recently observed that Exchange Online has switched to a lower version of TLS protocol. Emails from Exchange Online to Gmail and other Office 365 tenants are now sent over TLS 1.0 instead of TLS 1....
1
vote
1answer
72 views

Does a Mailbox Export Request modify the mailbox data?

The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest. What information is modified (if any) by the use ...
0
votes
0answers
824 views

Exchange Autodiscover XML question (Exploit related)

Recently we had an issue with the Exchange autodiscover.xml appending ".com" to our mail servers autodiscover address. It resulted in a certificate error due to the name not matching the certificate. ...
3
votes
2answers
219 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore have ...
8
votes
2answers
3k views

Do any Exchange hardening guidelines recommend disabling OWA Webready? Should they?

For the fourth time in over a year, Exchange OWA has put our internal network at risk due to a remote code execution flaw that exists on the server runtime. This risk is compounded by the fact ...
3
votes
3answers
4k views

Is sending email between different Office 365 domains (and organisations) secure?

Is sending emails between different Office 365 account owned by entirely separate entities secure? I.e. The email never leaves the Microsoft network? If the two are in the same data centre (E.g. ...
1
vote
1answer
86 views

Rerouting emails to external account

There was a case when employee A thought he was getting legitimate emails from employee B, as the email address was valid, there were no CC/BCC addresses and just plain text in the body. Some ...
5
votes
1answer
571 views

What is the security impact of changing PowerShell's PSLanguageMode?

A vendor is asking me to change the PSLanguageMode from within IIS on my Exchange server(s). What potential vulnerabilities am I opening myself up to? I'm surprised to see this option present within ...
1
vote
1answer
121 views

MS Exchange email privacy and Admins

Using the Exchange control panel feature/tool of MS Exchange 2010, you can search all the emails belonging to any domain user and read them. Allowing an Exchange administrator to read the emails of ...
1
vote
2answers
87 views

Is it possible to protect the emails and calendar in an Exchange server against own Exchange administrators?

We have our Exchange server in a remote site administered by an external provider. We would like to avoid the possibility of provider employees to access the email and calendar of critical accounts in ...
5
votes
1answer
276 views

Should I have special emoticon handling for compliance, audit and logging?

I'm required to audit various communications (email, sms, messenger, social media) for keywords relating to financial data, HIPPA, and other PII. Is there any rational reason I should extend my ...
2
votes
1answer
61 views

Are there any examples of when personal email data can be brought into a lawsuit involving a corporation?

If users bring their own device (BYOD) and they have corporate Exchange (or Goodlink email) on that device, could the other email accounts on that device be open to a legal search? Would the SMS ...
15
votes
2answers
65k views

Is there an SSL / TLS Certificate state-cache on Windows, IE, and Outlook and how it it managed?

Today I changed the SSL certificate that 3,000+ Outlook clients are using. In doing this I changed the certificate to an "older" one that had the same subject name, expiration and everything else. ...
1
vote
1answer
932 views

How to prevent users from copying their outlook pst file to an external disk or system

We allow 4 gb space per employee in outlook mail exchange, beyond that the user has to create a pst file . That is the policy. We have given admin rights to all employees since there is a lot of ...
2
votes
0answers
116 views

Are old Android WebViews a risk to Activesync email, and how do I block old devices?

I'm concerned that old versions of Android may be hacked through unpatched WebViews (in PhoneGap and other apps), exposing Activesync email data, and other sensitive information. To mitigate this, ...
1
vote
0answers
815 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
1
vote
0answers
162 views

Does Activesync certificate authentication replace a password, or act as 2 factor?

I am looking at Activesync authentication and want to know if Certificate Authentication ignores a client username and password or Certificate Authentication requires a username and password For ...
3
votes
1answer
219 views

Does PKCS #7 (CMS) add assurance to an email if a CRL/OCSP response is included, then revoked?

Suppose I issue a signing certificate in January, and have a daily CRL issued (expires in 1 day) to verify the validity of that signature. Then sometime in July I need to revoke that certificate. My ...
1
vote
0answers
387 views

How should an ISP approach Mutual Auth TLS for SMTP email? (Domain Auth Email)

I'm looking for an easy to deploy way to make email clients (MUAs) display my email messages in a secure manner. PGP and SMIME both do this today, but they are high touch, and require software or ...
2
votes
2answers
2k views

How can one secure Exchange 2010 cookies? [closed]

We have received the below finding from an IT audit. Missing Secure Attribute in Encrypted Session(SSL) Cookie: It is best business practice that any cookies that sent over (Set-cookie) an SSL ...
2
votes
3answers
2k views

OWA Keep-Alive in http, even though it should be forced https

Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the ASCII decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info ...
0
votes
2answers
469 views

When Activesync policy is applied to iPhones allows thumbprint-unlock, while Android does not. Which is correct?

We have a long-standing ActiveSync device policy that requires an unlock code for all phones that use corporate email. It seems that iPhones with "swipe to unlock" and Android phones with similar ...
5
votes
4answers
3k views

Exchange 2013 blocks txt file attachments - are there security reasons?

My Exchange Admin is setting up 2013, and it is set to block txt file attachments specifically (as well as others). I have tried searching for risks associated with txt attachments but could not ...
2
votes
2answers
1k views

OAuth Authorization flow and redirect

I started looking at OAuth - Google's and Facebook's implementation. Both of the implementations, in the authorisation flow, seem to send the "Authorization code" back to the web browser. I was ...
3
votes
2answers
214 views

What is the point of secure email gateways?

We run Exchange 2010. Our edge servers run "passive opportunistic TLS" for 99% of the domains we communicate with. For a handful of domains, we have forced TLS on both our end and the other domain's ...
1
vote
0answers
375 views

Securing MS Exchange [closed]

I have read quite a bit on the subject of securing MS Exchange - most notably the Client Access role. With the retirement of Microsoft's Threat Management Gateway many people seem to be looking for an ...