Microsoft Office 365 Security Recommendations

Summary As organizations adapt or change their enterprise collaboration capabilities to meet “telework” requirements, many organizations are migrating to Microsoft Office 365 O365 and other cloud collaboration services. Due to the speed of these deployments, organizations may not be fully...

Excelerating Analysis, Part 2 — X[LOOKUP] Gon’ Pivot To Ya

In December 2019, we published a blog post on augmenting analysis using Microsoft Excel for various data sets for incident response investigations. As we described, investigations often include custom or proprietary log formats and miscellaneous, non-traditional forensic artifacts. There are, of...

MSOLSpray - A Password Spraying Tool For Microsoft Online Accounts (Azure/O365)

A password spraying tool for Microsoft Online accounts Azure/O365. The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled. BE VERY CAREFUL NOT TO LOCKOUT ACCOUNTS! Why...

Quick Wins to Combat Data Leaks

Data leakage is a worry. Holding lots of sensitive information about your employees and your customers means that if data is exposed it would be a catastrophe. No one wants to be the next Mossack Fonseca, or Equifax, or Marriott Hotel, or Facebook, or… The majority of clients I speak to tell me...

Microsoft OAuth Flaw Opens Azure Accounts to Takeover

A vulnerability in the way Microsoft applications use OAuth for third-party authentication could allow an attacker to take over Azure cloud accounts. OAuth is a protocol that allows app users to share data about their accounts with third-party websites or apps, so that when they sign into the app...

o365.sejong.ac.kr Cross Site Scripting vulnerability

Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting o365.sejong.ac.kr website and its users. Following coordinat...

Vulnerable domain identification

Identifying potentially vulnerable Exchange endpoints Module Options msf use auxiliary/scanner/msmail/host/id msf undefinedid show actions ...actions... msf undefinedid set ACTION msf undefinedid show options ...show and set options... msf undefinedid run...

Use of Microsoft Authenticator App to as 2-factor authentication for O365 access using XenMobile

Question - Can we use the Microsoft Authenticator app as a means of 2-factor authentication to secure access to XenMobile integrated O365 environment? Answer - Currently use of Microsoft Authenticator as a means to provide 2-factor authentication is only possible for O365 apps. The security featu...

Has Your O365 Account Been Hacked?

In the past six months, Coalfire has seen an increase in businesses receiving fraudulent emails from legitimate client accounts with fraudulent invoice attachments. In several cases, the recipient paid the invoices not realizing they were fraudulent. The losses have ranged between thousands and...

CVE-2017-7229

PGP/MIME encrypted messages injected into a Vaultive O365 before 4.5.21 frontend via IMAP or SMTP have their Content-Type changed from 'Content-Type: multipart/encrypted; protocol="application/pgp-encrypted"; boundary="abc123abc123"' to 'Content-Type: text/plain' - this results in the encrypted...

Information disclosure

PGP/MIME encrypted messages injected into a Vaultive O365 before 4.5.21 frontend via IMAP or SMTP have their Content-Type changed from 'Content-Type: multipart/encrypted; protocol="application/pgp-encrypted"; boundary="abc123abc123"' to 'Content-Type: text/plain' - this results in the encrypted...

CVE-2017-7229

CVE-2017-7229 affects the Vaultive O365 appliance (pre-4.5.21). The vulnerability arises when PGP/MIME encrypted messages passing through IMAP/SMTP have their Content-Type header changed from multipart/encrypted to text/plain, causing most PGP/MIME-capable clients to fail decryption. This results...