Email Security

TheDogon · (#1 (**permalink**))

There seems to be a lot smart people in this forum.

Well, I have a tough one. I am administering a relatively small network for a company in Chicago. Some hacker has been able to successfully spoof a user on my network. He sent out an email to another company posing as a person who works here.

We are using Exchange 5.5. And our SMTP service is configured properly.

In order to for a person to use our server to send mail externally, they must first have avalid email address, then they must provide the password to use that address.

Of course, any person sending email to a user on our system can do so without any authentication.

Does anyone here know of hacking methods that allow someone to get around the security that comes with Exchange 5.5?

Thanks in advance.

safetyblitz · (#2 (**permalink**))

Patch your domain server, then patch your workstations as well as Exchange.

Run a virus scan because your users could have trojans. Also, I cannot think of the name of the software but one package checks viruses coming in on user email accounts and rejects the message if an attached virus is detected....

Did your user mistakenly volunteer out his/her pw? Did they open a trojan in an email and that grabbed your exchange servers list of email accounts and send that them back out via your server?

At that point they could have easily modified their email using the gather acct info and sent it from their end. Before you do anything check your logs, you may find what you are looking for there.

It is hard to trouble shoot across this medium but hopefully this basic steps will give you a starting point. IF these all check out we can continue but 9 times out of 10 your users are at fault.......

Abstract · (#3 (**permalink**))

safetyblitz wrote:

Quote:

Patch your domain server, then patch your workstations as well as Exchange.

Did your user mistakenly volunteer out his/her pw? Did they open a trojan in an email and that grabbed your exchange servers list of email accounts and send that them back out via your server?

At that point they could have easily modified their email using the gather acct info and sent it from their end. Before you do anything check your logs, you may find what you are looking for there.

It is hard to trouble shoot across this medium but hopefully this basic steps will give you a starting point. IF these all check out we can continue but 9 times out of 10 your users are at fault.......

---

definately most likely cause is "social engineering" i.e. dumb users giving away or being spoofed to give away secure details.

don't forget dumpster diving is a serious risk as well.

TheDogon · (#4 (**permalink**))

safetyblitz wrote:

Quote:

Patch your domain server, then patch your workstations as well as Exchange.

Run a virus scan because your users could have trojans. Also, I cannot think of the name of the software but one package checks viruses coming in on user email accounts and rejects the message if an attached virus is detected....

Did your user mistakenly volunteer out his/her pw? Did they open a trojan in an email and that grabbed your exchange servers list of email accounts and send that them back out via your server?

At that point they could have easily modified their email using the gather acct info and sent it from their end. Before you do anything check your logs, you may find what you are looking for there.

It is hard to trouble shoot across this medium but hopefully this basic steps will give you a starting point. IF these all check out we can continue but 9 times out of 10 your users are at fault.......

Quote:

Well, I am running GroupShield. It is running the latest update. As for our workstations, I force them to load the latest patch at login.

Quote:

Then I had this guy reset his password. It's a possibility that the hacker obtained it somehow.

Quote:

Thanks for the info. It's a possibility that he did open an infected email.