Discussion
One of our office 365 accounts seems to have been compromised
suppliers are receiving emails purporting to be from her however whilst they present as being from the correct email and from our domain they are actually from a totally different domain.
However the email does contain an email thread that is real and from her account.
They are definitely not being sent from our server, which is hosted office 365. We've run malware/virus detection and changed all passwords.
Anything else we can do?
suppliers are receiving emails purporting to be from her however whilst they present as being from the correct email and from our domain they are actually from a totally different domain.
However the email does contain an email thread that is real and from her account.
They are definitely not being sent from our server, which is hosted office 365. We've run malware/virus detection and changed all passwords.
Anything else we can do?
rxtx said:
juice said:
Have you implemented SPF/DKIM/DMARC ?
None of that will work if the receiving MTA doesn't acknowledge it.It's obvious that it is our system that has been compromised as the emails have gone to a few other parties but it's difficult to see how it's happened.
There's been a lot of this going around lately. Usual workflow:
> Send phishing emails to employees directing them to fake O365 login page.
> Capture inputted credentials, log in to real 365 using them.
> Send phishing emails to contacts directing them to a fake O365 login page.
Rinse and repeat. Best mitigation is forcing 2FA for all 365 and OWA access using a physical hard token or mobile app.
By "not from our domain", what do you mean exactly? Where are the SMTP headers indicating they're actually coming from, and through what hops? Various things suggested above will mitigate spoofing (to some degree at least) but if there's access to legitimate email threads then the problem is Layer 8.
The mail forwarding/outlook rules suggestion above is something that's also pretty common and would explain access to the email chain. Of course, that necessitates a compromise of the user's account.
Might be worth checking services like haveibeepwnd to see if the user has lost credentials through public dumps which might be reused for access.
> Send phishing emails to employees directing them to fake O365 login page.
> Capture inputted credentials, log in to real 365 using them.
> Send phishing emails to contacts directing them to a fake O365 login page.
Rinse and repeat. Best mitigation is forcing 2FA for all 365 and OWA access using a physical hard token or mobile app.
By "not from our domain", what do you mean exactly? Where are the SMTP headers indicating they're actually coming from, and through what hops? Various things suggested above will mitigate spoofing (to some degree at least) but if there's access to legitimate email threads then the problem is Layer 8.
The mail forwarding/outlook rules suggestion above is something that's also pretty common and would explain access to the email chain. Of course, that necessitates a compromise of the user's account.
Might be worth checking services like haveibeepwnd to see if the user has lost credentials through public dumps which might be reused for access.
Edited by HM-2 on Saturday 18th May 11:23
To clarify what I meant by "not from our domain"
The emails appear to come from our employee in that the "from" address appears correct.
(First name.lastname@ourdomain.co.uk) however it's actually from random@random.com)
It's not been sent from any of our accounts and we can't see any evidence that anything else has been changed.
The emails appear to come from our employee in that the "from" address appears correct.
(First name.lastname@ourdomain.co.uk) however it's actually from random@random.com)
It's not been sent from any of our accounts and we can't see any evidence that anything else has been changed.
Sheepshanks said:
Are there multiple emails with different genuine content being sent to multiple suppliers?
We've had unfathomable things happen on a one-off basis with Office365.
In simple terms yes. We've had unfathomable things happen on a one-off basis with Office365.
We can see no evidence of emails sent from our system but we have had a couple of phone calls and emails returned from contacts.
The email sent is a chasing a payment and the way our accounts system works that would never happen.
There are plenty of these emails about at the moment, and by that I mean "this week".
In the last 3 days I have had a bundle of "dating" emails, all with similar text, but all from different domains, and some are proper companies trading on the internet, selling proper stuff like building tools, car stuff and the like; the emails plainly didn't come from them, so I guess someone in Poland has just learned how to fake the "from" address.
In the last 3 days I have had a bundle of "dating" emails, all with similar text, but all from different domains, and some are proper companies trading on the internet, selling proper stuff like building tools, car stuff and the like; the emails plainly didn't come from them, so I guess someone in Poland has just learned how to fake the "from" address.
There is a lot of confusion about this stuff across pretty much all IT literacy levels and it is not helped by a bunch of competing and complimentary standards that are implemented "softly" if at all.
The fact we're even pondering whether it's just a spoofed From with a different Reply-To, whether its originated from the hacked O365 account, or even a hacked computer using a O365 as normal, etc cuts to the heart of the problem.
Stuff like SPF, DKIM, DMARC is all well and good but it's a bit of an safety illusion. It gives your email more authority, but if the recipient mail servers don't also implement it then its irrelevant. In my experience the ones that do implement it do so cautiously, with "soft fail" settings, because the risk of users or customers actually losing email is deemed far greater than the perceived risk.
I don't know the solution to this really, the whole system of internet email is to my mind fundamentally broken from a safety and standards point of view. So many users of email, the vast majority for sure, are completely oblivious to the fact that you can make an email appear at first glance to come from anyone. An email with a spoofed From name/address looks no different at all to any other email, because it isn't different, because clients are blindly trusted to provide this information and it does not need to correspond to any kind of authoritative identity. Again, SPF/DKIM/DMARC can help here but they are not and should not be considered to be a panacea for safety.
I think until such time as Google or Apple or ideally both of them come up with a new system of email identity authority (let's face it - it would need someone with their clout to actually change things), everyone who uses email should do so very cautiously.
The fact we're even pondering whether it's just a spoofed From with a different Reply-To, whether its originated from the hacked O365 account, or even a hacked computer using a O365 as normal, etc cuts to the heart of the problem.
Stuff like SPF, DKIM, DMARC is all well and good but it's a bit of an safety illusion. It gives your email more authority, but if the recipient mail servers don't also implement it then its irrelevant. In my experience the ones that do implement it do so cautiously, with "soft fail" settings, because the risk of users or customers actually losing email is deemed far greater than the perceived risk.
I don't know the solution to this really, the whole system of internet email is to my mind fundamentally broken from a safety and standards point of view. So many users of email, the vast majority for sure, are completely oblivious to the fact that you can make an email appear at first glance to come from anyone. An email with a spoofed From name/address looks no different at all to any other email, because it isn't different, because clients are blindly trusted to provide this information and it does not need to correspond to any kind of authoritative identity. Again, SPF/DKIM/DMARC can help here but they are not and should not be considered to be a panacea for safety.
I think until such time as Google or Apple or ideally both of them come up with a new system of email identity authority (let's face it - it would need someone with their clout to actually change things), everyone who uses email should do so very cautiously.
Based on an incident I had to deal with.
1. Implement 2FA on every O365 account - do this first. Note that "modern authentication" must be implemented for this to work - whether this is implemented already on your O365 tenant depends on how long ago it was set up. [I think I have that right]
2. Check any users involved for email forwarding to another account after implementing 2FA
3. Force a password change globally
In the specific incident I am referring to the FD had a forward to a gmail account (so they had broken his then password).
1. Implement 2FA on every O365 account - do this first. Note that "modern authentication" must be implemented for this to work - whether this is implemented already on your O365 tenant depends on how long ago it was set up. [I think I have that right]
2. Check any users involved for email forwarding to another account after implementing 2FA
3. Force a password change globally
In the specific incident I am referring to the FD had a forward to a gmail account (so they had broken his then password).
Art0ir said:
There are a number of technical solutions to phishing but nothing will be more effective than user training and awareness.
No organisation can ever hope to achieve a 0% click-through rate on phishing, and UAT will only take you so far. It should never be a one-or-the-other decision, but technical controls like proper 2FA (app or physical token based) mitigate 99.9% of the credential loss risk, even against sophisticated attackers, when properly configured.
The best you'll ever realistically get out of training is maybe 75% against the absolute billy-basic commodity stuff. Maybe 10-15% against high-end spear phishing abusing customer/supplier relationships etc.
desolate said:
In simple terms yes.
We can see no evidence of emails sent from our system but we have had a couple of phone calls and emails returned from contacts.
The email sent is a chasing a payment and the way our accounts system works that would never happen.
Are the legitimate conversations they've inserted themselves into with one specific supplier, or are they from multiple ones? If it was the former you would realistically expect they could be she source of the convo, but if it's multiple ones with various third parties that probably points to something closer to home...We can see no evidence of emails sent from our system but we have had a couple of phone calls and emails returned from contacts.
The email sent is a chasing a payment and the way our accounts system works that would never happen.
Edited by HM-2 on Monday 20th May 14:55
HM-2 said:
Are the legitimate conversations they've inserted themselves into with one specific supplier, or are they from multiple ones? If it was the former you would realistically expect they could be she source of the convo, but if it's multiple ones with various third parties that probably points to something closer to home...
It's a legitimate conversation sent to multiple suppliers chasing an amount in a manner that we would never do. It looks like they have managed to intercept some emails and then email contacts asking for a payment.
Also it looks like it was a one off event as nothing seems to have been sent subsequently - all passwords changed and 2 factor authentication turned on now.
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff