79 votes
Accepted

Did a Huawei modem just try to do a Man-In-The-Middle attack on me?

The router had briefly lost its WAN uplink. It's a “feature” in several manufacturers' routers and modems (specifically including Huawei, but others as well) to redirect you to the router's local &...
grawity's user avatar
  • 1,706
13 votes

Microsoft email servers "require remote control of Android device security features"

Thankfully, you don't surrender remote admin capabilities to Microsoft. However, you do surrender them to the e-mail system's administrator or some other IT admin there. Generally this is kind of ...
baldPrussian's user avatar
  • 2,778
10 votes
Accepted

Why does Outlook not block spam sent by employees?

Intra-domain emails (emails from your domain to someone else in your domain) have a much higher trust score, so they tend not to get blocked. This is done because legitimate employee-to-employee ...
schroeder's user avatar
  • 129k
8 votes

Microsoft email servers "require remote control of Android device security features"

I have seen several universities doing it this way: You can access your mailbox either using the Exchange protocol or using IMAP + SMTP. If you try to use the Exchange protocol with Android devices, ...
Jukka Suomela's user avatar
7 votes
Accepted

Can a JWT be all lowercase?

No, JWTs can never be either all lowercase or all uppercase. That's because they're a base64url encoding of a byte sequence that starts with {". All possible byte sequences starting with that, ...
bk2204's user avatar
  • 9,444
5 votes

How to prevent sharing SSH private keys by email

TL;DR: use smart cards. To prevent distributing the key to other persons you need to prevent that the user has read access to the key in the first place. The key is used in SSH for authentication. ...
Steffen Ullrich's user avatar
5 votes

Did a Huawei modem just try to do a Man-In-The-Middle attack on me?

Yes, the modem did try to MITM you. With probably good intentions. This is an impressively bad (in regard to security) approach to getting the user's attention. The problem is, they train the user to ...
fraxinus's user avatar
  • 3,568
4 votes

Can we infect our system by opening a email with outlook 2016?

Yes, no, maybe. On any given day, the right answer will be one of the three. Generally the right solution to the problem is considered to be assuming that you may be vulnerable and applying ...
symcbean's user avatar
  • 18.6k
4 votes
Accepted

Outlook rule to forward all emails - is that a common scam?

In my professional experience, this is not a common step from "hackers". However, I don't have any hard numbers to back that up, so I wouldn't take that statement as anything more than ...
Conor Mancone's user avatar
3 votes
Accepted

Microsoft Outlook Vulnerability CVE-2018-8587 - How likely is exploitation?

Getting a victim to open a file is a proven effective way to attack an organisation - phishing and social engineering work, very well. So assume that part of the attack is low effort if you or your ...
Rory Alsop's user avatar
  • 61.5k
3 votes
Accepted

Outlook for Android uses intermediate Microsoft Servers

Is it possible that they could be authenticating over a TLS tunnel from their own server rather than the client device without sharing the credentials? No, for the server to make the connection, ...
gowenfawr's user avatar
  • 72.9k
3 votes

How is my microsoft account compromised?

Changing a password does not typically revoke existing access. I'm not familiar enough with a Microsoft account, so I'll provide a general suggestion that many modern websites use. Twitter has a ...
kfordham281's user avatar
3 votes

What are the security risks of using downloadable email vs. remote/online email?

Both approaches have their own risks: If you have your mail remote then you fully depend on the security provided by the external provider. If you host it locally it is more under your control. Which ...
Steffen Ullrich's user avatar
2 votes

What are the security risks of using downloadable email vs. remote/online email?

Frankly speaking, the best is to use combination of both which is IMAPS. With IMAPS the connection is secuie (IMAP over SSL, or rather, TLS), and the client retrieves the list of emails and when you ...
Aria's user avatar
  • 2,731
2 votes

Does this strange string of letters indicate that my Outlook account has been hacked?

This does appear strange. It is something that the technical support people should know how to fix. (maybe they don't know, but they should) It is possible that it was a setting in your account with ...
700 Software's user avatar
2 votes

Does putting in quarentine attachments with two dots increase security in Outlook 2010?

Yes, but there is a difference. While "cute-kittens.gif.exe" can raise some eyebrows, since a GIF shouldn't be executable, I wouldn't say the same about .tar.gz files. To be more clear, .tar.gz should ...
A. Darwin's user avatar
  • 3,582
2 votes
Accepted

Can opening an email be tracked with a wav file?

It was once possible to embed audio into emails (including auto-play). Here's a 2012 article describing how it was done. This does not currently work in Gmail or Outlook 2016, but it may still work in ...
Sequoyah's user avatar
  • 145
2 votes

How to Force STARTTLS on Outlook and other clients

No, Outlook doesn't have an option to force TLS to be used when STARTTLS is selected for the encryption option. But if the server supports it, you can skip STARTTLS and just use TLS on the port where ...
Peter Duniho's user avatar
2 votes
Accepted

Can my company see the contents on my iPhone if I used my work email on it?

I doubt that they can actually see the content of your phone, however an exchange administrator is able to remotely wipe your device at any moment. This is usually done in case of a critical security ...
Samuryte's user avatar
2 votes

Encrypted email from outlook to other

Encrypted E-mail requires a bit of work by somebody. You've done the work for your users. Now the question is what's going on at the other end. The person on the other end will need to create (or ...
tjd's user avatar
  • 803
2 votes

Why does M365 keep accepting phishing emails that Gmail rejects?

Your work M365 administrator may have adjusted the sensitivity of the junk mail settings. You need to work with them to see how to improve the sensitivity.
schroeder's user avatar
  • 129k
1 vote

Can a forwarding rule be set on Outlook that will not be visible on office365/exchange admin interface?

Generally there are multiple Ways to forward E-Mails: Users can create a forwarding rule within Outlook or Outlook Web App An administrator can create a client rule for forwarding An administrator ...
Valentin's user avatar
  • 651
1 vote

Encrypted email from outlook to other

Yes, you can send S/MIME encrypted messages to other mail systems once you've set it up at your end. But the people you're emailing also need to set up S/MIME at their end and sadly S/MIME is not ...
Richard N's user avatar
  • 141
1 vote

Proving a forwarded email attachment was not modified

Your Sent Email folder will have the original. There may also be copies on the email server itself. Ask someone from the IT department or the email admin to verify either your Sent folder or the ...
schroeder's user avatar
  • 129k
1 vote

Proving a forwarded email attachment was not modified

Is there anyway to ... help to prove my innocence ...? Ask your client to send an Email send the email to your employer, if you can. In the future you can confirm that the Email is unchanged by ...
mentallurg's user avatar
  • 12.4k
1 vote

Outlook service is storing decrypted password in server memory – how insecure is it?

I believe it is fairly standard to keep secrets in memory. Why it is generally better not to store passwords themselves, but rather use tokens/keys, it is not too bad IMO. The app has to store some ...
Peter Harmann's user avatar
1 vote

Can opening an email be tracked with a wav file?

Broadly, yes... but it doesn't reveal a whole lot about you. Any link you click (whether from an email or elsewhere) makes an HTTP request to a remote server. The server handling the request will ...
nbering's user avatar
  • 4,038
1 vote

User mail certificates policy: Is expiration+renewal better than no-expiration+revocation?

The reason for the certificate's current invalidity is not relevant. If Outlook, or any client software, presents a different conclusion regarding the validity of a signature from either type of ...
mlp's user avatar
  • 546
1 vote

Why does Outlook not block spam sent by employees?

From what I experienced MS Office Outlook does not block Spam. Each time I receive a Spam email I tag it as Junk. Next time the same sender gets blocked. I found I have to create my own list. The ISP ...
Jerry Greenberg's user avatar
1 vote

Microsoft email servers "require remote control of Android device security features"

I have this issue too. I've read the text multiple times, and the way I interpret it is that the Gmail app is requesting all those permissions from the OS. The Gmail app doesn't tell how much of those ...
RdJNL's user avatar
  • 111

Only top scored, non community-wiki answers of a minimum length are eligible