Trusted by more than 2500 companies with over 5 million users

Ransomware Group Targets Microsoft Exchange Server with New Exploit OWASSRF

Threat actors affiliated with the Play ransomware strain are leveraging a never-before-seen exploit method that bypasses Microsoft’s ProxyNotShell URL rewrite mitigation. A New Exploit Chain CrowdStrike researchers have discovered a new exploit method they have named OWASSRF, or Outlook Web Access Server-Side Request Forgery. The novel exploit affects Exchange Server 2013, 2016 and 2019 by leveraging CVE-2022-41080 [...]

2022-12-27T07:28:49-05:00Blog, Exchange 2013, Exchange 2016, Exchange 2019, Exchange Security, OWA Security|

Microsoft Exchange Server Security: The 10 Best Ways to Secure Your Server

Security breaches cause organizational chaos, financial and reputation risk. Given how organizations have shifted to a hybrid of in-office and work-from-home, there is a significant increase in the security threat landscape, and it’s more important than ever to improve and harden Exchange Server security. These best practices help provide a baseline security framework that all [...]

2022-09-16T04:09:53-04:00Exchange 2013, Exchange 2016, Exchange 2019, Exchange Security, OWA Security|

Brute Force password attack causes massive Active Directory lockout at hospital

Early in the morning, a sudden spike in calls to the helpdesk for password resets and releases swamped IT-support staff at a hospital network. User accounts were under attack and Active Directory lockouts were spreading fast. Together we installed Messageware Exchange Protocol Guard (EPG) to look in detail at Outlook Web and immediately two things [...]

2022-05-19T03:22:22-04:00Blog, Exchange Security, OWA Security|

Notes From the Field: Government agency stolen passwords bypass 2FA Security

The UK's National Cyber Security Centre (NCSC) is warning that criminals are looking to exploit the trend toward home office (Coronavirus) to conduct cyberattacks and hacking campaigns. These ‘phishing’ attempts have been seen in several countries and can lead to significant losses: financial, reputational, and sensitive data. And no one is immune —as you'll read [...]

2021-10-14T06:09:15-04:00Blog, Exchange Security, OWA Security|

Bots Automatically Target Credit Union’s Exchange Servers With Password Spray Attacks

Exchange Server Hacks: Notes From The Field Cybersecurity is a top concern for everyone in the banking and financial sectors, and credit unions are no exception. The speed at which bots discover and target internet-facing Exchange Servers underscores the need for a variety of security solutions to minimize attack surfaces. In our fifth and final [...]

2021-08-24T10:32:32-04:00Exchange Security, OWA Security|

Telco Adds Exchange Server Protocol Guard to Prevent AD Lockouts Caused by 2FA Login Software

Exchange Server: Notes From the Field This case involves attacks at a division of a large Telco with a strong IT team operating more than sixty on-premises servers and mandated 2FA security solution for divisions managing their own Exchange Servers. And then … several incidents lead one Division’s security team to discover that password guessing [...]

2022-05-19T02:40:07-04:00Blog, Exchange Security, OWA Security|

Disgruntled ex-employee attacks Exchange Server with Outlook Mobile from their BYOD device

Exchange Server: Notes from the Field Support staff in a large manufacturing company were experiencing a sudden increase in the number of calls dealing with Active Directory user account lockouts and email password resets. The Exchange Server messaging group reached out to us for help. Together we installed Exchange Protocol Guard (EPG) to find out [...]

2021-07-27T11:32:43-04:00Blog, Exchange Security, OWA Security|

Protecting Outlook Web from DoS and Brute Force Attacks

Last week we highlighted the exposures that exist with attachments in Outlook Web. This week we look at protecting Outlook Web from Denial of Service and Brute Force Attacks. Depending upon how you have configured Outlook Web Access (OWA) and Active Directory, you will be opening your network up to either brute force attacks or denial of [...]

2022-09-05T04:51:47-04:00OWA Security|

5 Ways to Power Up 365 and Outlook Web (OWA)

Firstline workers comprise over 2 billion employees including retail sales associates, hospitality staff, medical workers and teams on the manufacturing floor. Often, they are the first and only representation of your brand with your customers. To help transform and empower this workforce at a reasonable cost, Microsoft created the Office 365 F1 plan (a replacement [...]

2023-02-09T06:51:03-05:00Blog, Exchange 2016, Exchange 2019, OWA Security, OWA Suite|

7 Ways to Secure Sensitive Corporate Data Crossing the Border

Recently, The New York Times ran an article warning travelers to exercise the same degree of security over data on mobile devices as they would in protecting themselves from muggers. The warning comes in the wake of increased pressure by foreign and domestic governments for travelers to hand over devices and passwords because border agents [...]

2022-06-06T05:44:15-04:00Blog, Exchange Security, MDM, OWA Security|

Wait! Don’t STOP your Exchange Outlook Web Deployment!

Most IT organizations have to deal with remote workers, employees who travel or telecommute, temporary contractors and agents or staff who are simply being productive at home. For all these people, email remains the bedrock of corporate communication. Without it they simply wouldn’t get their jobs done. So for organizations that use Microsoft Exchange Server, [...]

2019-08-24T01:11:23-04:00Blog, Outlook Web, OWA Security|

Are Your Microsoft Outlook Web Attachments Secure?

Last week we demonstrated a variety of ways in which an OWA session can be compromised, even though the user may have been doing their best to follow company security policies. This week's series of tests will highlight the exposures that exist with attachments in Outlook Web. Simply follow the steps described in the following usage cases to expose [...]

2022-06-11T09:43:17-04:00OWA Security, Technical OWA Tips|

Is Your Microsoft Outlook Web Secure?

Nowadays employees are mobile and constantly connected; the traditional work environment has expanded beyond the physical office walls to include coffee shops, airports, and home. Unfortunately, all this increased mobility and flexibility has exposed new security risks for businesses and IT, risks that sophisticated hackers are quick to exploit.  […]

2022-06-11T09:49:24-04:00OWA Security, Technical OWA Tips, Uncategorized|

Give Your Organization a Secure OWA Experience

These days, it’s challenging to read anything about the Internet without stumbling across an article about security concerns. Recent events have brought online security and Internet confidence to the forefront once again. We, at Messageware, think this is a good thing - a very good thing. We want you to be thinking about it, to [...]

2022-06-06T04:55:47-04:00OWA Guard, OWA Security, Technical OWA Tips|

Cyber-attacks launched against Outlook Web App users

An attack campaign using advanced cyber-espionage techniques launched against Office 365’s Outlook Web App users in an attempt to steal email log-in credentials from the employees of military agencies, embassies, defense contractors and international media outlets. The group behind the attack used an interesting technique against organizations using OWA; for each attack they used JavaScript [...]

2022-06-11T09:44:35-04:00Blog, OWA Security|

Prevent Data Loss from Email Attachments in OWA with Messageware AttachView

Whether your motivation for implementing Data Loss Prevention strategies is to protect your organization’s intellectual property, or to remain compliant with regulations in your industry, your Microsoft Exchange and OWA deployment should be considered as one data source requiring careful scrutiny for DLP possibilities

2022-06-06T05:01:52-04:00OWA Security|

Exchange OWA Deployments Are Not Safe from Brute Force Attacks

  I recently read an interesting article that stated “automated password-cracking software can perform 100 million checks per second – equating to a four-character password being cracked in 0.16 seconds, and a six-character password in just 11.4 minutes.” (SC Magazine, February 2013) When you think about a typical user password, it is no wonder why [...]

2019-01-15T10:21:32-05:00Blog, OWA Security|

OWA Protection Against Cybercrime with FBI Security Recommendations #2

Messageware can help you meet the FBI’s recommendations for protecting your organization against cyber threats by securing the OWA Sign-On page and providing insight into logon and connection activity. Cyber-crime is on the rise, and it is old news that organizations need to secure all access points into their corporate networks to [...]

2022-06-06T07:15:44-04:00Blog, OWA Security|