tl;dr – If you are using Microsoft Office 365 (or any other hosted email solution) and have not enabled two factor authentication, you are bad and you should feel bad
Microsoft and other cloud vendors really need to make two factor authentication the default for their email and other business critical cloud applications. You should have to make an active decision to turn off 2FA and be forced to watch a video about companies who were hacked as a result of lack of 2FA in order to make the decision stick.
I spent too much time today dealing with two business partners (one small and the other large) from whom my users received multiple emails containing PDF phishing documents. These emails were hard for users to recognize as bad – they came from a real email account of a real person at a real firm that they had done business with.
What had happened is that our partners were using hosted email and had not enabled two factor authentication. A user at each got phished and the attacker in each case took control of their email to send the evil documents to all of their contacts.
Fortunately for us, our protections worked – user awareness training and multiple layers of web and email filtering alerted us to the problem and none of our users fell into the trap lain by the attacker.
It could have been much worse. A more sophisticated attacker could have utilized the identities of the email senders in a more sophisticated way, such as to redirect payments on invoices or to get our users to disclose confidential information. Or who knows what.
That being said, it still is pretty bad – any information we sent to those email accounts in the past is now in the hands of who knows who. We are reviewing the traffic to the hacked accounts to determine what could have been exposed. While it seems that these guys were not after intellectual property, we will never know where that information ends up.
The decision on the part of these two partners to not have 2FA has real costs for my firm – users had to be notified, all emails sent to those partners need to be reviewed for sensitive information and an incident report written.
For now, I am pulling all of our email logs to determine which of our vendors are using various hosted email platforms and sending them a note inquiring as to whether they use 2FA. If not, we are going to have some serious talks with them about their security posture. We’re also going to start monitoring for partners who move from on-prem to hosted email.
This type of attack is happening way too often and opens up companies who never signed up for these hosted services to risk which just should not be there.
Off to look at emails…
RSS - Posts