Threat Geek

Securing Outlook - Going From Hazy To Clear

Whatever your job description, there's a fair chance that you spend a considerable part of your day doing email. And the odds are that you're using Microsoft Outlook as your client application and that on the back-end, you're connecting to a Microsoft Exchange server.

Now if your responsibilities include security, you're acutely aware that email is the classic vector for phishing attempts from the outside and is a key means of data exfiltration by insiders, inadvertant or otherwise. Spear-phishing, where a highly targeted attack against a specific individual or group is attempted, is probably the top-of-mind threat of the moment, deployed in such famed penetrations as the RSA attack of early 2011. All of this would suggest that you'd be very interested in examining the contents of emails coming to and from your users.

The typical way this is done is by using a network traffic analyzer that understands SMTP or one that can be used as an MTA to plug into your email infrastructure. These rely on standards-based approaches for monitoring emails going between MTAs, essentially email servers. There are a number of solutions that would enable you to do this, including ones that we at Fidelis offer. Depending on your enterprise IT and security architecture, you might see limitations to this approach and it's worth talking through these.

A happy trend for the enterprise over the past few years has been the consolidation of IT resources driven by better software, management tools, Moore's law and virtualization. Instead of every branch office, division or business unit deploying it's own Exchange servers, it's quite likely that your organization has decided to centralize this setup.

But a somewhat less happier outcome for you as the security guy is that you may no longer have visibility into your organization's email. If your Exchange servers are outside your control or security perimeter, instead of inspecting SMTP or deploying MTAs to do content examination, what you're stuck with on the network is Microsoft's proprietary MAPI protocol, which is what Outlook clients use to talk to Exchange Servers. Most network sensors today aren't capable of inspecting messages travelling over MAPI.

This is a real problem, because you've just lost visibility into the inbound and outbound threats carried over enterprise email. You might choose to rely on your enterprise-level security team to take care of this with their monitoring of SMTP. But consider the data exfiltration case where it's highly likely that you're the best judge of what is sensitive to your organization. Your enterprise security team might be able to deploy standard rules to look for PII leakage but your operational security vocabulary is probably your own - codenames, project plans ... the kind of stuff you don't want showing up on Wikileaks or even Gizmodo.

Even worse, you really have no control over email between users on the same Exchange server. Everyone is familiar with viruses that blast out emails to all addresses in the victim's address book. Imagine someone in your domain getting infected with such a virus and sending emails to his colleagues. This is a fantastic phishing vector, since a user is a lot more likely to open an attachment coming from a sender inside their organization. Emails within an Exchange domain never make their way to SMTP or other MTAs and are likely to get no inspection whatsoever.

All of this points to the need for network-based sensors that can understand and inspect sessions carried over MAPI - the protocol that Outlook user-agents use to connect to Exchange servers.

Today Fidelis announced addition of the Exchange/MAPI decoder to our XPS product family. Our policy framework can now be utilized against MAPI-based sessions, thus giving you visibility and control into email (and Calender) based threats inside your organization, whether or not you have the ability to wrap your Exchange sever with security tools of your choice. Even better, the Exchange/MAPI decoder gives you visibility into intra-organization emails that you never had before. If email based threats matter to you, your outlook just brightened up. To read more about the Exchange/MAPI decoder, see our press release.

- Hardik Modi

THREAT GEEK WEEKLY UPDATE - DECEMBER 1, 2011

1.      Top 10 Dumb Computer Security Notions and Myths

While organizations are deploying firewalls, public key cryptography and complying with various security and privacy regulations, many of them are still hanging onto certain misperceptions, "falsehoods" and approaches that don't work, Charles Pfleeger, a security consultant and principal of the Pfleeger Consulting Group, said in a keynote speech at a recent security event jointly held by Kaspersky Lab and NYU-Polytechnic University in New York City. "There are a lot of dumb ideas," Pfleeger said, noting that some of the misconceptions can be found within the security community itself. In his keynote speech, Pfleeger used construction analogies to illustrate the importance of building applications and designing IT architectures with security in mind. It's easier to build a house with electricity from the start, rather than breaking into a freshly painted wall later to install cables, Pfleeger said. IT and security professionals should learn to recognize bad ideas for what they are and counter the erroneous notions when they come across them, he said. For this slide show, eWEEK chatted with security experts to expand on Pfleeger's initial list to highlight myths and fatuous ideas that put enterprises and users at risk.

2.      Cyberattacks a top national security concern, GOP candidates say

Three Republican presidential candidates at Tuesday's CNN-sponsored GOP debate said that cyberattacks pose an emerging national security threat to the United States. In closing comments during the debate, GOP hopeful Newt Gingrich, the former Speaker of the House, said that he views cyberattacks as one of three major security threats the U.S. is currently unprepared to deal with.

3.      Marriott’s Hacker’s Blackmail Goal: An IT Job

Marriott International Corp. was recently the victim of a rare type of targeted attack: A hacker pilfered sensitive documents from the hotel chain and then attempted to use the stolen intelligence to blackmail it for employment. Attila Nemeth, 26, from Hungary, has pleaded guilty in U.S. District Court to hacking and extortion charges stemming from a bizarre case in which he placed backdoor malware on Marriott computers, exfiltrated sensitive documents, and then threatened Marriott with exposing the information if the company didn't offer him an IT position.

4.      New Facebook worm spreading

Researchers from the Danish security firm CSIS, have intercepted a currently spreading Facebook worm. The worm spreads by sending direct messages using the privileges of the already logged in user. The message looks like an image file, whereas in reality it has an executable .scr screensaver extension. Upon execution, the sample drops a ZeuS crimeware variant on the infected host. The malware is hosted on compromised web servers across the globe.

5.      FBI, DHS say no evidence of a hack in an Illinois water district pump failure

The FBI and Department of Homeland Security say they can't find evidence to confirm any of the story that an Illinois water authority's SCADA network was hacked and that it resulted in burning out a pump in the system. "There is no evidence to support ... claims that any credentials were stolen, or that the vendor was involved in any malicious activity that led to a pump failure at the water plant," according to a story published by the BBC.

 

The ThreatGeek Top 5 is a weekly post that identifies relevant industry news and stories. Check in to stay up to date with the latest happenings throughout the industry.