applied security research
Rik van Duijn - 26 mei 2020

Phishing aftercare

This blog is part of our Office 365 attack & defense series. We also maintain a Github page where we share our Office 365 tools and queries. We often get sent phishing emails by family and friends. Not to phish us but because we ask family and friends to forward them to us. Sometimes they also send them to ask us for a second opinion. For us its an interesting insight into what people get sent and sometimes the start of a fun research project. Usually these phishing attempts are a standard and untargeted, sometimes they are clearly an internal phishing test. If a message seems targeted towards a person or organization we always advise them to contact internal IT administration or security departments. Unfortunately people often do not respond positively to this advice. Submitting the message is too complex and there is no feedback whether or not it was malicious.

Handling user-reports

Recently we got another message: “Hey is this right?” including a screenshot of an email. The email described the email storage quota was exceeded. And in the attachments a word document with the instructions on how to fix the quota. The email message used the organization name and so did the filename of the word document. It’s still unclear if this is a phishing test by the organization or an actual phishing attempt. We used this phishing scenario in the past so it did feel like phishing but in the end it didn’t feel right. So I advised to contact their IT department. The immediate response was they didn’t want to do so: the last phishing message they forwarded, returned a snarky response stating they didn’t follow proper procedure. Which is unfortunate: as a defender getting these messages from our colleagues helps us to detect threats. Recently the university of Maastricht was hacked and ransomed. The initial vector: phishing. phishing. Awareness and reporting on its own is obviously not enough but making sure everyone reports if they see something suspicious will help. Next to making it easy to report users need to receive feedback of their report. If someone feels they are contributing they will be more willing to send them in.

Helping users report phishing

Having a quick and easy procedure to receive the messages is important. But we need the original message so we could instruct users to only forward as attachment. But this is not a button that is in the main screen and would require users to click around. As IT we sometimes forget that an employee is not there to act as a human spam filter. So that notification should be made as simple as possible. It is easy for office365 and exchange users to receive notification from users. A user can classify an email as spam or phishing in the web interface. Normally all email will go directly to Microsoft. But it is also possible to receive it yourself. A mail flow rule allows the messages sent to Microsoft to be bcc-ourselves. Now suppose you don’t want Microsoft to receive these messages, you can also choose to redirect the message instead of sending a bcc. How to do this is at the bottom of the article. Technically not very complicated to receive a phishing report. Now it remains for us to inform our colleagues how to report. And providing feedback and the latter can be difficult. Not every report is relevant at all and, depending on the size of the organization, it does not scale to respond 1-on-1. An option could be to include something like this in the newsletter or to raffle something cool under the best phishing submission. It doesn’t really matter, as long as you show that you do something with it!

Configure mailflow:

Setting up the mail flow rule can be done in 2 ways, via the GUI and via powershell.

Via the GUI

  1. Log in to the Exchange Admin center
  2. Select “email flow”
  3. Select “rules”
  4. Create a new rule with the following properties:
    • Apply this rule if … Recipient is “abuse@messaging.microsoft.com” or “junk@office365.microsoft.com” or “phish@office365.microsoft.com”
    • Do the following … BCC or Redirect* the message to “an email address you like”
* the Redirect To options will make sure the Phishing email is not send to Microsoft but to you instead.

PowerShell FTW:

What can be done by hand is easier with PowerShell, replace -BlindCopyTo with -RedirectMessageTo if you don’t want these messages to be sent to Microsoft. The script is also available in our Github repository:

#Modify email adress and rule name below: 
$recipient = "YOUREMAILADRESS"
$name = "[ZOLDER] Recieve user alerts"

New-TransportRule $name -SentTo "abuse@messaging.microsoft.com","junk@office365.microsoft.com","phish@office365.microsoft.com" -BlindCopyTo $recipient -StopRuleProcessing $false -Mode "Enforce" -Comment "" -RuleErrorAction "Ignore" -SenderAddressLocation "Header"


Bonus

You can add text or html to any email from outside of the company. This allows you to add a warning to emails from external sources. Which could help users identify false messages. We’ve added the script to our Github repository, use it to add this to your o365 environment. You can add your own organisation name, the layout looks like this: Don’t forget to inform users of this change, if they know it’ll be added they will be better prepared to use it.
Blogs

Breda Robotics

Erik Remmelzwaal - 10 mei 2021
Zolder BV is toegetreden tot het netwerk van Breda Robotics. Deze vereniging brengt organisaties bij elkaar die actief zijn rondom robotisering in de regio West-Brabant. Voor Zolder geeft Breda Robotics de mogelijkheid om samen te werken met de robotiseringsindustrie. Te begrijpen hoe die sector precies werk en op welke vlakken cybersecurity kennis kan worden ingezet […] Lees verder

27% .nl domeinen slecht beschermd tegen spoofing

Erik Remmelzwaal - 29 apr 2021
TLDR: We scanden de DNS records van 1,6 miljoen .nl domeinen en vonden uit: 9% is rechtstreeks gekoppeld aan Microsoft 365, daarmee is Microsoft veruit de grootste Google is nr2 en heeft 4% van de domeinen aan zich verbonden, nagenoeg gelijk aan een aantal andere spelers. Van alle mail-enabled domeinen heeft 27% geen SPF record […] Lees verder

Zolder biedt MKB betaalbare en eenvoudige security-app

Zolder B.V. - 12 apr 2021
“Attic voorkomt dat security een luchtbel wordt” Security is bij mkb-bedrijven vaak het ondergeschoven kindje. Ze hebben er de mensen en het budget niet voor. Dat maakt deze doelgroep een aantrekkelijk doelwit voor cybercriminelen. Voor de vier doorgewinterde cybersecurity-experts van start-up Zolder reden om Attic te introduceren. Deze eenvoudige, goedkope en toekomstbestendige app maakt mkb’ers […] Lees verder

Nieuwe Themesong voor Zoldersessions

Erik Remmelzwaal - 13 mrt 2021
Ik vond het tijd worden voor een nieuw liedje voor onze Zoldersessions. Tot nu toe hadden we er een rechtenvrij liedje onder staan, namelijk EVA_失望した, maar wilden toch iets meer 'eigens'. Daar schakelden we Bjørgen van Essen voor in met dit eindresultaat. Dit is hoe dat tot stand kwam. Lees verder

Zolder.App Open Beta

Zolder B.V. - 02 feb 2021
We launched the final beta release to the Google and Apple appstores. Any business running on Microsoft 365 is more than welcome to join. As a beta-tester you will receive a free subscription to the Zolder.App Premium Plan for the remainder of the beta phase, which is scheduled to run through April 30th 2021. Zolder.App […] Lees verder

GGD data is topje van ijsberg

Erik Remmelzwaal - 26 jan 2021
Maandag kwam RTL Nieuws, na onderzoek van Daniël Verlaan, naar buiten met het nieuws dat gestolen data van de GGD online wordt verhandeld door criminelen. Het gaat om data die onderdeel uitmaakt van het bron- en contactonderzoek dat de GGD uitvoert als onderdeel van de bestrijding van Corona/COVID-19. De data bevat gevoelige persoonsgegevens en criminelen […] Lees verder

#CES2021 - We Are Ready!

Erik Remmelzwaal - 06 jan 2021
We are very excited to be part of the #CES2021NL mission! Meet us at CES (Januari 11-14) in our online booth 10609 and see how we solve global challenges with NLTech. Erik Remmelzwaal, Co-Founder & CEO Yes I indeed think we are ready for CES. At this virtual event we will showcase Zolder.App. I am […] Lees verder

Zolder.App Blog 3 - Feedback

Erik Remmelzwaal - 27 nov 2020
Bij het ontwikkelen van een nieuwe dienst, zeker als dit Software-as-a-Service betreft, is feedback vanuit (potentiële) afnemers cruciaal. In het geval van Zolder.App is de doelgroep het MKB. We zijn al gelijk na lancering van het merk Zolder gestart met het vinden van MKB-ers die als tester wilden helpen. Oproep 19-apr-2020 Dit leidde tot best […] Lees verder

Azure App Consent Policies

Rik van Duijn - 11 nov 2020
OAuth consent phishing has been on the rise for a while now. Unsurprisingly, Microsoft has gradually introduced measures to protect from this type of attack. Latest: Risk-Based Step-Up Consent. Lees verder

Honeytokens using Azure Keyvaults

Rik van Duijn - 15 okt 2020
In 2017 Wesley and I gave a presentation at SHA2017 about honey/pot/tokens. We actually planned on building a fully fledged platform. But never came further then the POC phase of that project. This week we got a product demo from the guys at Thinkst, i’ve always loved this way of thinking: let the attacker come […] Lees verder

Zolder.App Blog 2 - Probleem & Oplossing

Zolder B.V. - 08 okt 2020
Het is best een goed idee om voordat je begint met het bouwen van een product of dienst, te weten welk probleem je ermee gaat oplossen. Voor Zolder.App: we lossen het probleem dat MKB-ers slecht beveiligd zijn op door enterprise-niveau security voor hen toegankelijk te maken. In feite zijn er een aantal problemen die we […] Lees verder

Risk of exposed home automation services

Wesley Neelen - 24 sep 2020
At home, I am automating many things for fun. Currently I am using Home Assistant, an incredibly powerful piece of software for automating your home. Regularly I am combining the home automation experiences with security. Home automation is often related to physical things such as changing lights, moving curtains, opening door locks or turning the […] Lees verder

Zoldersessions Studio Setup

Zolder B.V. - 27 aug 2020
Here is the kitlist which we end up with to record our Zoldersessions 🙂 Audio Input 4x Rode Procaster microphone 4x Triton Audio FetHead Microphone PreAmp 4x YellowTec m!ka Mic Boom Focusrite Scarlett 18i8 3rd gen Audio Output 4x Shure SRH840 Headphone ART HeadAmp 4 headphone amplifier Video Input 2x Sony Handycam main cameras Logitech […] Lees verder

Zolder.App blog 1 - het idee

Erik Remmelzwaal - 27 aug 2020
Op Zolder bouwen wij aan een mobiele app die MKB’ers op een baanbrekende manier moet helpen digitaal weerbaar te zijn. We verwachten in het vierde kwartaal van 2020 de app te kunnen lanceren. In deze blogreeks neem ik je mee in de ontwikkeling van Zolder.App. Eigenlijk was er niet 1 idee, maar is Zolder.App het […] Lees verder

Hacking the traffic light of the future

Wesley Neelen - 06 aug 2020
Nowadays we are connecting everything we can think of to the internet. Usually to make our lives easier or more comfortable. Some of the new upcoming innovations are related to making our traffic smart with the goal to improve safety, comfort and the traffic flow. We dived into this technology to analyze the inner workings and identify potential security risks. Lees verder

Detect lateral movement with Azure Sentinel

Wesley Neelen - 01 jul 2020
Lately we have been setting up a the production network for our Zolder.App service. The network consists of multiple segments separated by a firewall. As an addition we wanted to add monitoring features into the network. If an attacker is in our network, we would like to get a notification. Lees verder

CSBN 2020

Erik Remmelzwaal - 01 jul 2020
Het jaarlijks CSBN is weer beschikbaar. Het Cybersecurity Beeld Nederland, opgemaakt door onze overheid in de hoedanigheid van de NCTV. Aan afkortingen geen gebrek. Dat maakt het gelijk ook heel taaie kost: ingewikkeld om te doorgronden. Je gaat haast denken dat het ook de bedoeling is dat we er niet teveel aandacht aan besteden. Of […] Lees verder

Detecting BEC fraud using Azure Sentinel

Rik van Duijn - 17 jun 2020
Business Email Compromise (BEC) Fraud inflicts the most damage of all types of cybercrime, according to the FBI. How to detect such attacks using Azure Sentinel? Rik shares some actual possibilities. Lees verder

Security-by-design. Zo makkelijk is dat niet

Wesley Neelen - 16 jun 2020
Wesley beschrijft de complexiteit bij het bouwen van een netwerk infrastructuur: kies je voor veiligheid of werkbaarheid? Of is er een optimale mix? Lees verder

Phishing aftercare

Rik van Duijn - 26 mei 2020
This blog is part of our Office 365 attack & defense series. We also maintain a Github page where we share our Office 365 tools and queries. We often get sent phishing emails by family and friends. Not to phish us but because we ask family and friends to forward them to us. Sometimes they […] Lees verder