Tag: Hacking

Posted on by

Find Out Who Is Using BCC External Emails on Exchange Online 365

Get IT Help For Freelancers, And Small Business Owners for $69!

Who In Your Company Is Using BCC Emails on External Emails? (on Exchange Online 365)

There are cases especially when dealing with Data Leakage Prevention scenario in which you need to know who is using BCC and to whom are they sending, usually the focus is on internal to external emails.

* Yes, you can block the BCC availability if you wish (Via GPO and other options)

 

Finding out who is using BCC seems like an easy task for your IT Systems admin to check but when using Exchange Online 365 or Exchange 2013 and onwards, the task is a bit complicated, there is no BCC log.

In order to enable this type of logging in Exchange Online 365 we need to make a small workaround:

  1. Recommended – Create a dedicated mailbox
  2. Create a new rule in 365 Exchange Admin to Generate Report for every internal > External email, this is also a very useful tool as a Journal ( because Office 365 online wont let you use an online mailbox as a Journal)
  3. Make sure the “Custom Content” has BCC select
  4. The above rule will send reports on ALL internal > External email that are being sent in your organization, now we need to filter them.
  5. Create an OUTLOOK Rule ( the rule will work on the server level but created from OUTLOOK) to move any Report to a specific Folder
  6. Now we need to Separate an email that has BCC in the report from “normal external emails”, Create an OUTLOOK rule to separate the emails based on “BCC:” content , VERY IMPORTANT to make this rule AFTER the previous rule
  7.  Now you can create if you want another rule to delete any report that does not have a BCC in it, i personally recommend having a dedicated mailbox which will hold all reports as a type of a Journal – very useful for forensics and quicker that MESSAGE TRACE
  8. for the Advanced user – have a look at Microsoft FLOW features that can convert Emails to SQL, when the data is in SQL you can create alerts and combine the system with your DLP policy
  9. The same logic is even more useful when you have RMS or AIP , then you can make the same reports run via classification, for example WHO is sending CLASSIFIED emails with BCC.

No shortcuts – we always need to be one step ahead.

Written by Eli Migdal – TowerWatch Solutions – CEO

*This article originally appears on Linkedin here*

Have more questions? Check out our Smiley Geeks IT Help Membership from only $69 a month!

Posted on by

How To Protect Your Email Password From Hackers

*This article originally appeared here on LinkedIn* How To Protect Your Email Password From Hackers

In my previous article I have showed how easy it is for hackers to get your outlook & 365 password.

The method I showed requires the hacker to be on the same network as you (WI-FI or Local) but usually hackers will use much easier way to obtain your password:

Spearhead phishing & Social Engineering is very effective and works from my experience in many cases – they are waiting for you to be a off your guard for a second and then they will get your email password (you will give them the password … )

There are several very easy steps that from my professional experience reduce the risk significantly:

The basics:

  1. Don’t be cheap and use a business grade email solutions like Microsoft 365 or Google Apps – you are paying for added security / traceability and support. the worst Hacks i have seen are always with “Free” email accounts such as Yahoo, Gmail and such where you don’t have a real “point of contact” when you need help
  2. Use complex passwords (Example@78!) – don’t use the same password you use for other service !

Use the Advanced feature that the business grade solutions offer you – use 2 Form Authentication (for more information, visit our 2-Form Authentication post for an in depth look at this.)

Use 2 Form Authentication – it will require you provide another authentication via SMS / APP and will make it MUCH more harder for the hacker to hack your email account

Both Microsoft and Google offer 2 Form Authentication solutions,

Microsoft 2FA

Google 2FA

both of them will require you to provide a one time password via SMS / APP when you login.

Both of them also support “APP Password” that will provide you a one time password for your APP ( such as outlook ), This is very useful to avoid the type of “Men in The Middle” attack I have shown in the previous article

Generally speaking Hackers usually search for the ” weak link ” in the chain – dont let it be you – do what ever you can to make it complex for them so they will move on to another person / company.

Never say it wont happen to you… when it does it hurts more and you will regret not taking the basics steps to protect yourself and protect your email password.

Written by Eli Migdal, CEO of TowerWatch Solutions Ltd (UK) and founder of Migdal Computing Solutions Ltd (Israel)

Posted on by

How to protect yourself from Password Hacking – Two form Authentication – (Because Just a Password is Not Enough)

Let us start with a reality check – passwords get hacked and stolen all the time, this is a fact! So proactively protecting yourself from password hacking is a must!

Passwords are compromised when they are “hacked” by professional hackers, or exposed through careless user behavior, and even discovered by “password guessing”, which uses information readily available in social media and other sources, things like birthdays, names of children and relatives, pets, school names and so on.

Even if you are a careful and responsible user, choosing only secure and smart passwords, you can be under threat from a penetration from the server side, which is totally outside you control.

You need a password anyway – so choose it wisely:

  •  Create a password which is not connected to yourself in any direct way. For example, you can always choose something suitable for  the moment, or chose an object that is right in front of you
  • Create a smart password that includes letters, numbers and at least one complex symbol
  • Create different passwords for different sensitive accounts, for example – different and non-connected passwords for your bank, Facebook or eBay accounts, so that if one of the password is compromised, other accounts still remain protected.
  • You should be especially careful when working with systems that can cause significant financial damage, like banks, PayPal, etc

How can you protect yourself ?

You cannot depend just on your password, you also should use an additional authentication method:

Two-Form Authentication is based on the principle of using two verification stages in order to access the system:

  • PASSWORD
  • Additional verification key, such as text message or a mobile app

Accessing a secure system must necessitate verification by both methods simultaneously, so that even if the password is lost or stolen, and comes into possession of an unauthorized persons, it will not be possible to access the system without the additional verification.

phone lit with black background

The Way It Works:

It can be seen using the example of Gmail: if you have a enabled a two-form verification function for your Gmail account, you will be required to type in your password, and straight after that to input a code that will be sent to your mobile phone by text message.

Why It Works:

Two-Form Authentication raises the level of verification for your personal identity and makes it much harder for a stranger to hack your account

In most cases, two-form authentication is based on using your mobile phone, utilizing text messages or dedicated applications.

  • Mobile phones and the text messaging tools are usually the more secure of most personal computer systems. They are very difficult for most hackers to be able to penetrate them, most of them just do not have the tools for that
  • Your mobile phone, together with its text messaging ability, is usually in your direct and personal possession, ensuring that an additional verification code will be delivered to you personally, checking your identity in order to be sure that you are the person trying to access the account

This way a two-form authentication system ensures that you are the person typing in the password, and not a wrongdoer.

Two-Form Authentication – two barriers for the hacker:

Two-form authentication forces the hacker to try and penetrate two defence barriers simultaneously. This makes the penetration process extremely difficult, and in most cases this will be enough to deter the wrongdoer from even trying.

Activating it – for a private user:

These days, most popular websites and applications, such as Gmail, Facebook and Dropbox, are equipped with integral built-in two-form authentication capability, you just need to activate it.

Below you can find the activation links:

Facebook https://www.facebook.com/note.php?note_id=10150172618258920

Gmail https://support.google.com/accounts/answer/180744?hl=en

Dropbox https://www.dropbox.com/help/363

Activating it – for a business user:

These days a business user cannot have any excuses for not securing his system, as the two-form authentication can be integrated in almost any business or office system.

Now it is possible to implement two-form authentication even for SSO (Single Sign On) systems, and obtain the management and security capabilities of Active Directory environment together with the protection given by two-form authentication.

Here is the list of business services that have the capability for integrating two-form authentication:

  • Active Directory (for accessing the operating system)
  • Terminal Server
  • Outlook Web Access
  • VPN
  • ERP systems
  • CRM systems
  • All the AZURE/365 products, provided by Microsoft, have the capability for integrated two-form authentication solution
  • FORTINET offers  integrated two-form authentication in most of its products, through the easy and effective use of their cloud  network, which serves as a verifying tool, without a need to integrate a RADIUS server

Below you can see our demo clip for Secure Envoy application that enables 2FA in the full AD environment, describing access to a computer, terminal server and OWA