Hot answers tagged

10

Thankfully, you don't surrender remote admin capabilities to Microsoft. However, you do surrender them to the e-mail system's administrator or some other IT admin there. Generally this is kind of security done at a corporate level. Corporations are as a whole concerned about loss of their intellectual property or privileged information (such as customer ...


9

Intra-domain emails (emails from your domain to someone else in your domain) have a much higher trust score, so they tend not to get blocked. This is done because legitimate employee-to-employee emails can look a lot like spam ("check out these pictures of my cat! [link]") . This is an ease of use issue. The sensitivity level of this can be changed on the ...


5

TL;DR: use smart cards. To prevent distributing the key to other persons you need to prevent that the user has read access to the key in the first place. The key is used in SSH for authentication. The authentication process involves cryptographic operations (signing) which need to have read access to the key. In order to protect the users key against ...


5

I have seen several universities doing it this way: You can access your mailbox either using the Exchange protocol or using IMAP + SMTP. If you try to use the Exchange protocol with Android devices, you will get the remote access silliness that you described. However, if you use IMAP + SMTP, you can avoid this issue. (Yes, this doesn't make much sense. Yes,...


4

In my professional experience, this is not a common step from "hackers". However, I don't have any hard numbers to back that up, so I wouldn't take that statement as anything more than anecdotal evidence. However, it's worth stating the obvious about why the hacker did this. What it really comes down to is that the attacker used this, effectively, as a ...


4

Yes, no, maybe. On any given day, the right answer will be one of the three. Generally the right solution to the problem is considered to be assuming that you may be vulnerable and applying mitigation (firewalls, anti-malware & backups are the essential ones).


3

Changing a password does not typically revoke existing access. I'm not familiar enough with a Microsoft account, so I'll provide a general suggestion that many modern websites use. Twitter has a section in your profile settings that list all connected applications to your account. This can be other twitter clients, or other services that use your twitter ...


2

This does appear strange. It is something that the technical support people should know how to fix. (maybe they don't know, but they should) It is possible that it was a setting in your account with this string. If that is the case you can change it back, and that is a clue your account was hacked. It is possible this is due to a bug in their software, in ...


2

Yes, but there is a difference. While "cute-kittens.gif.exe" can raise some eyebrows, since a GIF shouldn't be executable, I wouldn't say the same about .tar.gz files. To be more clear, .tar.gz should be considered as dangerous as .zip. In fact, since any compressed archive coming from a Unix-like system is usually .tar.gz, a .tar.gz file could have a ...


2

Both approaches have their own risks: If you have your mail remote then you fully depend on the security provided by the external provider. If you host it locally it is more under your control. Which is more better depends an what you and what the provider are able and willing to do regarding security but the provider is definitely the more lucrative target ...


2

I doubt that they can actually see the content of your phone, however an exchange administrator is able to remotely wipe your device at any moment. This is usually done in case of a critical security risk coming from your device, which can also be the phone being lost. They can also turn off phone functions such as bluetooth, web browser, camera, etc.. ...


2

It was once possible to embed audio into emails (including auto-play). Here's a 2012 article describing how it was done. This does not currently work in Gmail or Outlook 2016, but it may still work in other email clients. So if the recipient is using an email client that supports this, then yes it would be possible to track email opens this way, in exactly ...


2

Getting a victim to open a file is a proven effective way to attack an organisation - phishing and social engineering work, very well. So assume that part of the attack is low effort if you or your organisation is a target. As regards anything that sounds like complex crafting of a payload, if it can be created it will. The market in attacks flows down from ...


1

If the attacker was able to execute PowerShell in your environment he or she could have used the Set-Mailbox cmdlet to do this. It can set up forwarding for any user and leave a copy in the original mailbox so it’s quite transparent. Your bigger concern is: someone is able to run PowerShell in your environment with the permissions of your Exchange admin and ...


1

Is it possible that they could be authenticating over a TLS tunnel from their own server rather than the client device without sharing the credentials? No, for the server to make the connection, it has to know the credentials. And we know that the server does make the connection, not the client, because I captured all the packets coming off my Android ...


1

Encrypted E-mail requires a bit of work by somebody. You've done the work for your users. Now the question is what's going on at the other end. The person on the other end will need to create (or have created for them) an SMIME certificate and private key. Then the folks at each end will want to exchange SMIME certificates. Many mail clients can be ...


1

Broadly, yes... but it doesn't reveal a whole lot about you. Any link you click (whether from an email or elsewhere) makes an HTTP request to a remote server. The server handling the request will receive some details about what you were asking for (domain name, filename, the IP you made the request from, etc). So whatever information is in the link address,...


1

The reason for the certificate's current invalidity is not relevant. If Outlook, or any client software, presents a different conclusion regarding the validity of a signature from either type of certificate (expired, or revoked) then the software is broken and a bug report should be filed with the vendor. If the signature was made while the certificate was ...


1

Your Sent Email folder will have the original. There may also be copies on the email server itself. Ask someone from the IT department or the email admin to verify either your Sent folder or the server copies.


1

Is there anyway to ... help to prove my innocence ...? Ask your client to send an Email send the email to your employer, if you can. In the future you can confirm that the Email is unchanged by automatically signing your Emails with SSL certificate. There are a lot of providers of affordable certificates. In the popular Email clients like MS Outlook there ...


1

I believe it is fairly standard to keep secrets in memory. Why it is generally better not to store passwords themselves, but rather use tokens/keys, it is not too bad IMO. The app has to store some kind of authentication token/key anyway, so by not using password, the only gain would be that an attacker capable of obtaining said key/token would loose access ...


1

From what I experienced MS Office Outlook does not block Spam. Each time I receive a Spam email I tag it as Junk. Next time the same sender gets blocked. I found I have to create my own list. The ISP I am with has Spam filtering. It is adjustable by sensitivity, and also allows the user to filter out by server name, and or by email address. I found their ...


1

Smart Cards are one way to go. Another way would be to use ephemeral short-lived certificates instead of static keys for authentication. There are numerous open source implementations around using a certificate authority for SSH instead of static keys. One such system is called Cashier, currently maintained by an SRE from Intercom. Another that handles ...


1

Short answer, no, its not possible. The user needs permission to read the key to use it, and if they can read the key they can copy it. It is possible to restrict access to the key, e.g. if it resides on a unix box, then don't give the user permission to read the key, but allow them to run ssh via sudo. Or use a locked down mswindows jump box with remote ...


1

So, how do I know if a session to the account has expired if I can't logout from it? If you can still access resources which require your authorization then you are not logged out. Thus simply try to access new mails or similar in case of Outlook web interface. Could a failure to logout be a sign that someone else accessing my account? Probably not. But ...


1

Wow, lots in that question to try and get through. First, what might you be missing? I'd suggest two things from experience. Firstly, the client PC's should only run whitelisted applications, everything else should be blocked. This cancels out masses of malware. Second, kill off access to all known advert servers, malware sources and command and control (...


1

Frankly speaking, the best is to use combination of both which is IMAPS. With IMAPS the connection is secuie (IMAP over SSL, or rather, TLS), and the client retrieves the list of emails and when you click on email, it is downloaded. Similarly Exchange protocol works this way. So it keeps email on the server so you can browse them online and downloads the one ...


Only top voted, non community-wiki answers of a minimum length are eligible