Security Updates Exchange 2013-2019

Exchange2019LogoA quick blog on recently published security updates for Exchange Server 2013 up to Exchange Server 2019. These fixes address the following vulnerabilities:

  • CVE-2019-1373: Microsoft Exchange Remote Code Execution Vulnerability

The CVE documents contain more details on the vulnerabilities. The exploits can be fixed by single security update, which you can find in the table below per current Exchange version.

ExchangeDownloadBuildKBSupersedes
Exchange 2019 CU3Download15.2.464.7 KB4523171KB4515832
Exchange 2019 CU2Download15.2.397.9 KB4523171 KB4515832
Exchange 2016 CU14Download15.1.1847.5 KB4523171 KB4515832
Exchange 2016 CU13Download15.1.1779.7 KB4523171 KB4515832
Exchange 2013 CU23Download15.0.1497.4 KB4523171 KB4509409

Be advised that the Security Updates for Exchange 2013-2019 are Cumulative Update level specific. Unfortunately, the security update carries the same name for different CUs, and you cannot apply the update for Exchange 2016 CU14 to Exchange 2016 CU13. I would suggest tagging the Cumulative Update in the file name when you store it, e.g. Exchange2016-CU14-KB4523171-x64-en.msp.

As with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Ignite 2019: Exchange & Related Sessions

ignite2019Note: If you are looking for the script to download Ignite contents, you can find it at the TechNet Gallery or Github.

It shouldn’t be a surprise to you, but this is the week of Ignite 2019 in Orlando, where Microsoft and other speakers will not only tell you about the latest and greatest, and how to implement recent products and use their technologies, but also draw more of the roadmap of things to come. Unfortunately, I won’t be attending Ignite (again), but similar to last year Microsoft will be live streaming keynotes, breakouts as well as theater sessions. So, you can watch stuff as it happens in the comfort of your own home or on-demand at a later time.

To access the catalog, including live streams, you can of course dive in the 1981 sessions located on the Ignite portal. Details on sessions, speakers etc. as well as filtering options are already present to help you pick what to watch, and recorded media will be added as it becomes available, including slidedecks.

For your convenience, I made a short list of sessions on Exchange Server, related technologies such as Outlook Mobile but also Teams and Groups, as well as some potentially interesting IT Pros sessions on Graph:

Session When Title Speakers
BRK2296 11/4/2019 2:15 PM Communication in Microsoft 365: Outlook and Teams integration opportunities Brandon Haist
THR2269 11/4/2019 3:00 PM Using Microsoft Teams: What’s new and how to get started Aya Tange, Jeremy Chapman
THR3039 11/4/2019 3:25 PM What’s new in the Office Customization Tool Chris Hopkins
BRK3095 11/4/2019 4:30 PM Understanding the importance of collaboration in modern work and the role O365 plays to unlock your team?s productivity Ronald Pessner, Patrick Gan, Dan Costenaro, Megan Dohnal
BRK2056 11/4/2019 4:30 PM Embrace Office 365 Groups: What’s new and what’s next Mike McLean, Venkat Ayyadevara
BRK2001 11/4/2019 4:30 PM What’s amazing and new in calendaring in Outlook Julia Foran
THR3084 11/4/2019 5:45 PM Microsoft 365 admin: Ask us anything Aaron Woo, Ben Appleby, Alice Appleton, Tim Heeney, Karissa Larson, Yeonsoo Kim
THR1131 11/4/2019 6:20 PM The solution to intranet adoption…Microsoft Teams Daniel Diefendorf
BRK3013 11/5/2019 9:00 AM Modern Exchange IT admin experiences Rahul Gupta, Eddie Savage
BRK1079 11/5/2019 10:15 AM Five hybrid cloud backup and disaster recovery mistakes to avoid Douglas Ko, Shawn Gifford, Carl Holzhauer, Julian Simpson
BRK3140 11/5/2019 10:15 AM Notes from the field: Successfully steering the government to Office 365 Michael Van Horenbeeck
BRK3012 11/5/2019 10:15 AM Exchange hybrid: Advanced scenarios, roadmap, and real-world stories! Andy Ryan, William Holmes
THR2016 11/5/2019 10:20 AM Outlook for Windows: What’s new and what’s next David Gorelik
THR3082 11/5/2019 10:55 AM Protect against phishing and other cyberthreats with Microsoft 365 Business David Bjurman-Birr
THR3083 11/5/2019 12:40 PM Office 365 Groups: Ask us anything Mike McLean, Venkat Ayyadevara, Kolvekar Loveleen Ramachandra, Nivedita Rajani, Salil Kakkar, Arunkumaran Varadharajan
THR2252 11/5/2019 1:50 PM How Microsoft manages its own employee Office 365 tenancy David Haam, David Johnson, Darren Moffatt
ADM50 11/5/2019 2:00 PM Managing across tenant boundaries in Office 365 Steve Silverberg, Robert Lowe
BRK2003 11/6/2019 9:00 AM Get ahead with Outlook mobile: Intelligent technology that helps you stay on top of your day Tali Roth, Michael Palermiti
MLS1035 11/6/2019 9:15 AM Microsoft Graph 101 for developers and IT professionals Yina Arenas, Jeremy Thake
THR3003 11/6/2019 10:55 AM New, fast, and reliable Exchange Online PowerShell cmdlets Tony Redmond
BRK3311 11/6/2019 11:30 AM Outlook mobile: The gold standard for secure communications in the enterprise Ross Smith, Lexi Torres
BRK2005 11/6/2019 12:45 PM Outlook for Mac – re-invented! Vivek Kumar, Alessio Roic
THR2270 11/6/2019 1:50 PM Microsoft Teams for IT admins: What’s new and what you need to know with Anne Michels Anne Michels, Jeremy Chapman
THR2007 11/7/2019 9:00 AM Stop organizing your own meetings ? Let Scheduler do it for you Warren Johnson
BRK3264 11/7/2019 10:15 AM Transform collaboration and fight shadow IT with Office 365 groups Arunkumaran Varadharajan, Sahil Arora
THR3033 11/7/2019 11:30 AM Reading SMTP headers like a boss Jeff Guillet
BRK2059 11/7/2019 11:30 AM Data residency with Office 365 datacenters Brian Day, Adriana Wood
THR2217 11/7/2019 12:05 PM Email is the easy part: Five pitfalls to avoid in tenant-to-tenant migrations Paul Robichaux
BRK3144 11/7/2019 1:00 PM The MVP guide to Office 365 security, Exchange Online edition Theresa Miller
BRK3142 11/7/2019 2:15 PM Things you never knew about Microsoft Teams that might be important some day Tony Redmond
BRK3312 11/7/2019 3:15 PM Office 365 email enhancements that makes your organization smart, safe, and secure Leena Sheth, Kevin Shaughnessy
BRK2104 11/7/2019 3:15 PM Your users are under attack! Strengthen your anti-phishing defense with these O365 ATP best practices Girish Chander
BRK2058 11/8/2019 9:00 AM Deploy Office 365 groups at scale to power Microsoft Teams, Outlook, Yammer, and SharePoint Salil Kakkar, Martina Grom
BRK2002 11/8/2019 9:00 AM There is a new Outlook on the web: See what’s new, fresh, and exciting David Meyers
BRK2090 11/8/2019 9:15 AM Will Microsoft Teams take over from email? Tony Redmond
BRK3248 11/8/2019 10:15 AM Securing Exchange Online from modern threats Brandon Koeller
BRK3257 11/8/2019 10:30 AM Leverage the cloud to strengthen your on-premises Active Directory security Charity Shelbourne, Mark Morowczynski
THR3034 11/8/2019 12:05 PM Twenty minutes to a secure environment Jeff Guillet

Note that the table above was constructed using the Get-EventSession script. I’ll be closely monitoring things this week to try to make sure it can retrieve Ignite contents as it gets published and cope with any changes in publishing as happened in recent years during the event.

Exchange Updates – Sep. 2019

Exchange2019LogoToday, the Exchange Team released the quarterly Cumulative Updates for Exchange Server 2019 as well as Exchange 2016. The fixes in each release, product downloads are described below:

VersionBuildKBDownloadUMLPSchema
Exchange 2019 CU315.2.464.5KB4514141VLSC N
Exchange 2016 CU1415.1.1847.3KB4514140DownloadUMLPN

Exchange 2019 CU3 fixes:

  • 4515257 Hash mismatch is reported for Exchange DLLs in the bin directory of Exchange Server 2019
  • 4502159 Adding or removing mailbox permission in EAC doesn’t address the msExchDelegateListLink attribute in Exchange Server 2019 and 2016
  • 4515276 Room mailbox accepts a meeting as “Free” if a booking delegate is set in Exchange Server 2019 and 2016
  • 4515275 Enable Get/Restore-RecoverableItems to work with Purges folder in Exchange Server 2019 and 2016
  • 4515274 AutodiscoverV2 request returns REST API endpoint not AutoDiscoverV1 endpoint in Exchange Server 2019 and 2016
  • 4515269 SentToMemberOf shows every recipient type not distribution groups when you create transport rule in Exchange Server 2019 and 2016
  • 4515272 Message is blocked in “SMTP Delivery to Mailbox” queue if exchange server is added in groups of a child domain in Exchange Server 2019 and 2016
  • 4515271 Can’t convert a migrated remote user mailbox to shared in Exchange Server 2019 and 2016
  • 4515270 SubmissionQueueLengthMonitor shows “System.ArgumentException: Transition timeout…” in Exchange Server 2019 and 2016
  • 4515267 NDR occurs when you resend message from alternate journaling mailbox to journaling mailbox in Exchange Server 2019 and 2016
  • 4515265 Removing In-Place Hold doesn’t work for mailboxes in different domains in Exchange Server 2019 and 2016
  • 4515264 FindPeople request from Skype for Business on Mac fails with “Invalid Shape Specification” in Exchange Server 2019 and 2016
  • 4515263 Hide the “Validate-MailFlowThroughFrontDoor” command for Exchange Server 2019 and 2016
  • 4515262 Enable Remove-MobileDevice to delete mobile devices after migrating to Office 365 from Exchange Server 2019 and 2016
  • 4515261 Can’t copy eDiscovery search results for mailboxes with Exchange online archives in Office 365 in Exchange Server 2019 and 2016
  • 4515273 Mailbox auditing fails when using SHA1Managed in Exchange Server 2019 and 2016
  • 4515266 Infinite loop in Recurrence.GetNumberOfYearsBetween() with the Japanese calendar in Exchange Server 2019 and 2016
  • 4520319 S/MIME signed reply draft behaves like the first message in conversation in Exchange Server 2019 and 2016
  • 4515832 Description of the security update for Microsoft Exchange Server 2019 and 2016: September 10, 2019

Exchange 2016 CU14 fixes:

  • 4515255 “X-InnerException: Microsoft.Mapi.MapiExceptionRpcServerTooBusy” error when you try to use a mailbox in Exchange Server 2016
  • 4515254 Event 1009 frequently occurs in application logs for lagged database copies in Exchange Server 2016
  • 4502159 Adding or removing mailbox permission in EAC doesn’t address the msExchDelegateListLink attribute in Exchange Server 2016
  • 4515276 Room mailbox accepts a meeting as “Free” if a booking delegate is set in Exchange Server 2016
  • 4515275 Enable Get/Restore-RecoverableItems to work with Purges folder in Exchange Server 2016
  • 4515274 AutodiscoverV2 request returns REST API endpoint not AutoDiscoverV1 endpoint in Exchange Server 2016
  • 4515269 SentToMemberOf shows every recipient type not distribution groups when creating transport rule in Exchange Server 2016
  • 4515272 Message is blocked in “SMTP Delivery to Mailbox” queue if exchange server is added in groups of a child domain in Exchange Server 2016
  • 4515271 Can’t convert a migrated remote user mailbox to shared in Exchange Server 2016
  • 4515270 SubmissionQueueLengthMonitor shows “System.ArgumentException: Transition timeout…” in Exchange Server 2016
  • 4515267 NDR occurs when you resend message from alternate journaling mailbox to journaling mailbox in Exchange Server 2016
  • 4515265 Removing In-Place Hold doesn’t work for mailboxes in different domains in Exchange Server 2016
  • 4515264 FindPeople request from Skype for Business on Mac fails with “Invalid Shape Specification” in Exchange Server 2016
  • 4515263 Hide the “Validate-MailFlowThroughFrontDoor” command for Exchange Server 2016
  • 4515262 Enable Remove-MobileDevice to delete mobile devices after migrating to Office 365 from Exchange Server 2016
  • 4515261 Can’t copy eDiscovery search results for mailboxes with Exchange online archives in Office 365 in Exchange Server 2016
  • 4515273 Mailbox auditing fails when you use SHA1Managed in Exchange Server 2016
  • 4515266 Infinite loop in Recurrence.GetNumberOfYearsBetween() with the Japanese calendar in Exchange Server 2016
  • 4520319 S/MIME signed reply draft behaves like the first message in conversation in Exchange Server 2016
  • 4515832 Description of the security update for Microsoft Exchange Server 2019 and 2016: September 10, 2019

Notes:

  • These Cumulative Updates do not contain schema changes compared to their previous Cumulative Update.
  • When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
  • Don’t forget to put the Exchange server in maintenance mode prior to updating. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
  • When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to delay installing at most one version (n-1).
  • If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
  • Cumulative Updates can be installed directly; no need to install RTM prior to installing Cumulative Updates.
  • Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
  • The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing, non-internet-facing servers first, followed by Edge Transports.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

Security Updates Exchange 2016 & 2019 (Sep2019)

Today, Microsoft published security fixes for Exchange Server 2016 and 2019. These fixes address the following vulnerabilities:

The CVE documents contain more details on the vulnerabilities. These exploits can be fixed by single security updates; you can download them here:

VersionLinksBuildKB
2019 CU2Download15.2.397.6KB4515832
2019 CU1Download15.2.330.10KB4515832
2016 CU13Download15.1.1779.5KB4515832
2016 CU12Download15.1.1713.9KB4515832

Note: KB4515832 supersedes KB4509409 and KB4509408.

Be advised that these Security Updates are Cumulative Update level specific. Unfortunately, the security update carries the same name for different CU’s, and you cannot apply the same update for Exchange 2016 CU13 to Exchange 2016 CU12. I would suggest tagging the Cumulative Update in the file name when you store it, e.g. Exchange2016-KB4515832-x64-en_CU11.msp.

As with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Security Updates Exchange 2010-2019

A quick blog that rather silently, Microsoft published hotfixes for a number of products few days ago, including Exchange Server 2010 up to Exchange Server 2019. These fixes address the following vulnerabilities:

  • CVE-2019-1084: Microsoft Exchange Information Disclosure Vulnerability, allowing non-printable characters to be added to Display Names.
  • CVE-2019-1136: Microsoft Exchange Server Elevation of Privilege Vulnerability, allowing NTLM MITM elevation permissions or impersonation through Exchange Web Services. This sounds like a variation on the NTLM MITM exploit which was fixed earlier this year with the February update cycle.
  • CVE-2019-1137: Microsoft Exchange Server Spoofing Vulnerability, allowing for cross-site scripting (XSS).

The CVE documents contain more details on the vulnerabilities. These exploits can be fixed by single security updates; you can download them here:

VersionCVE
2019
1084
CVE
2019
1136
CVE
2019
1137
DownloadBuildKB
2019 CU2XXLink15.2.397.54509408
2019 CU1XXLink15.2.330.94509408
2016 CU13XXXLink15.1.1779.44509409
2016 CU12XXXLink15.1.1713.84509409
2013 CU23XXXLink15.0.1497.34509409
2010 SP3 RU29XXLink14.3.468.04509410

Be advised that the Security Updates for Exchange 2013-2019 are Cumulative Update level specific. Unfortunately, the security update carries the same name for different CU’s, and you cannot apply the update for Exchange 2016 CU12 to Exchange 2016 CU11. I would suggest tagging the Cumulative Update in the file name when you store it, e.g. Exchange2016-KB4503027-x64-en_CU11.msp.

As with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Exchange Hybrid Agent GA

Ex2013 LogoIn February, Microsoft released the initial public preview version of the Hybrid Agent. The purpose of the Hybrid Agent, also branded as the “Exchange Modern Hybrid Topology”, is to simplify the process of setting up and deploying Microsoft Exchange Hybrid for Exchange 2010 and later deployments, where full “classic” Exchange Hybrid is not an option.

It can also address scenarios where deploying the Hybrid Agent would satisfy organizational migration requirements. For example, moving mailboxes between Exchange Online and Exchange on-premises while providing rich-coexistence features, but without requiring (re)configuration of the publishing of Exchange services. Other functionality the Hybrid Agent doesn’t offer is mail transport. Future builds of the Hybrid Agent might introduce cross-premises functionality, such as Send As delegations as demonstrated at Microsoft Ignite last year.

This week, the Hybrid Agent Public reached General Availability status. In the following article for ENow, I discuss the major changes in the agent since the initial Preview release.

Read the full article on the ENow Software blog.

ADV190018: Security Updates Exchange 2013-2019 & 2010

Ex2013 LogoUpdated Jun13: Corrected Ex2010SP3RU28 link

A quick note that an update was released for current Exchange versions as well as Exchange 2010 related to the following advisory:

  • ADV190018 Microsoft Exchange Server Defense in Depth Update

Unfortunately – or perhaps understandably – the advisory doesn’t present any more details than, ‘”Microsoft has released an update for Microsoft Exchange Server that provides enhanced security as a defense in depth measure.”.

You can download the security updates here:

Be advised that the Security Updates for Exchange 2013-2019 are Cumulative Update level specific. Unfortunately, the security update carries the same name for different CU’s, and you cannot apply the update for Exchange 2016 CU12 to Exchange 2016 CU11. I would suggest tagging the Cumulative Update in the file name when you store it, e.g. Exchange2016-KB4503027-x64-en_CU11.msp.

As with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Turla LightNeuron: Facts from Fud

fudYesterday, an article was published on ZDNet, where the author claims “Russian Cyberspies” are exploiting a backdoor in Exchange. The article is based on a report of Slovakian-based ESET Research, which is no stranger on the anti-virus/malware market. The report, titled “Turla LightNeuron, One email away from remote code execution”, claims the group – Turla – leverages LightNeuron to exploit Exchange Server for malicious usage, using instructions hidden in image attachments delivered through e-mail to control the backdoor. The news was quickly picked up by other media, and it didn’t take long for customers to start asking questions on the topic. Time for some fact checking.

Exchange Backdoor
The article claims the group using ‘one of the most complex backdoors’ ever spotted on an email server. While complexity is relative, it could very well be that this backdoor was indeed discovered on some improperly managed Exchange Servers in the wild.

However, the exploit leverages an installed malicious MTA (Message Transfer Agent, or Transport Agents in Exchange).  An MTA is software handling incoming and outgoing e-mail messages using the Simple Mail Transfer Protocol (SMTP). A lot of legitimate 3rd party MTAs exist for Exchange Server, for example to add disclaimers to messages or for message hygiene purposes.

This LightNeuron is the actual backdoor, so there is no backdoor in Exchange. A totally different conclusion than one could read from the article’s title, and a totally different attack vector:

  • How did this Transport Agent get installed on Exchange server in the first place?
  • How was it possible to store the DLLs required by the Transport Agents, and which are likely to get caught by AV products, on Exchange Server?
  • How was it possible to perform these tasks using administrative access, which is required to install such components in the first place?

The ESET report mentions this requirement; the ZDNET article and all other media simply omit this. Note that developing your own Transport Agent isn’t rocket science; Microsoft provides instructions on how to write your own custom Transport Agent for Exchange Server on-premises.

Hidden Instructions
Sending instructions hidden in images isn’t new. Steganography became famous to public in the last decade, where Osama Bin Laden was claimed to be embedding instructions for his followers in images posted on the internet. Little messages can also easily be embedded in the structure of an image file format, with places to store custom data or instructions.

Remote Control
As the installed malicious MTA runs under administrative permissions, it is no surprise that whoever (remotely) controls the MTA, in principle controls the Exchange Server as it runs in the context of the Exchange Trusted Subsystem.

Remote Controlled malicious code is not new; it is what drives zombie computers, and it is what made some prank tools popular in the mid-90’s, when you could prank your coworkers by opening their CD trays (anyone remember those?).

Impact
ESET claims that Turla has been leveraging LightNeuron for nearly 5 years, “which shows the tool’s advanced capabilities, being able to avoid detection for so many years”. In my opinion, this shows how many organizations have more bigger issues, such as an improperly managed mail environment.

SendMail
The report also mentions LightNeuron being ported to *NIX as well, e.g. SendMail. This shows perfectly that any communications system, when compromised, can be used for man-in-the-middle attacks. However, mentioning leaks in SendMail might not drive traffic as much as mentioning ‘Backdoor in Exchange’ for media, which is a driver when you depend on advertisements.

Detection
The article claims the hidden messages make LightNeuron hard to detect. Of course, this depends. The backdoor requires installation and presence of two malicious DLL files. Any respectable AV product should catch those. Windows Server 2016+ comes with Windows Defender, which according to its encyclopaedia should be able to detect Turla variants.

Removal
Finally, the article claims that, “removing this backdoor is quite problematic”. This is utter nonsense, as any weathered Exchange administrator should be able to install or uninstall Transport Agents as part of their skill set.

Conclusion
In summary and concluding:

  • This is not a backdoor in Exchange Server.
  • The backdoor is a malicious Transport Agent which needs to be installed on the Exchange Server
  • Installing this backdoor requires administrative permissions.
  • Well-managed Exchange environments should be OK.
  • Removal is simple, and a task any Exchange admin should be able to perform.
  • Windows Defender detects Turla variants.

And last but not least:

  • Media should do proper fact-checking as opposed to blindly copying articles.
  • Media should use titles which reflect the contents, and refrain from click-bait titles.
  • ESET is a vendor selling e-mail hygiene and security-related products, which always is a potential red flag when these kinds of reports are published.

Security Updates for Spoofing Vulnerability

Ex2013 LogoUpdated April 12th: Notice on KB4487563

Today, as part of patch Tuesday, supported Exchange versions received security updates to remediate the following issues:

Security updates are available for the following product levels, and fix the vulnerability mentioned:

Build KB Download CVE-2019-0817 CVE-2019-0858
Exchange 2019 CU1 15.2.330.7 KB4487563 Download Yes Yes
Exchange 2019 15.2.221.16 KB4487563 Download Yes Yes
Exchange 2016 CU12 15.1.1713.6 KB4487563 Download Yes Yes
Exchange 2016 CU11 15.1.1591.16 KB487563 Download Yes Yes
Exchange 2013 CU22 15.0.1473.4 KB487563 Download Yes Yes
Exchange 2010 SP3 RU27 14.3.452.0 KB4491413 Download Yes No

Notes:

  • CVS-2019-0858 does not apply to Exchange 2010.
  • Exchange 2010 is currently in Extended Support. Extended support for Exchange 2010 ends January 14, 2020.
  • Don’t forget to put the Exchange server in maintenance mode prior to updating.
  • If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
  • The order of installation shouldn’t matter with the “every server is an island” concept, yet recommended is to upgrade internet-facing first, followed by non-internet-facing servers, and finally Edge Transports.

Notice on KB4487563:
Apart from the known issues mentioned in KB4487563, there are reports the fix terminates while stopping services, and the following error is being logged:
[Error] System.Management.Automation.CommandNotFoundException: The term ‘Stop-SetupService’ is not recognized as the name of a cmdlet, function, script file, or operable program.

This Stop-SetupService isn’t a regular cmdlet, and I assume is an alias created by the update. However, there are reports this operation fails. In those circumstances, next to retrying installation of the update, a workaround might be opening up a PowerShell session and adding the alias yourself using New-Alias Stop-SetupService Stop-Service, followed by running the update. The alias isn’t persistent, so will be gone after you close your session.

Caution:
As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

End Users & External Messages

Ex2013 LogoIn the ongoing battle against spam and phishing, technical measures have much effect as they are able to triage spam or phishing messages based on configuration or programmed rules. By now, many of these measures have been widely adopted to limit messages of those categories to reach the inbox of the end user. Measures like SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting and Conformance) can be used to validate origination or contents of the message, or authenticate senders.

This post isn’t about those measures or how to implement them. I suggest reading this excellent DMARC implementation guide by MSFT’s Martijn van Geffen for more information on how to implement SPF and DMARC successfully. Note that his website also contains lots of tools and scripts to troubleshoot and report on SPF/DMARC. If you’re unfamiliair with his site, I suggest you have a look.

One of the weaker links in the whole chain of messaging remains the end end user. One can still devise technical measures up to a point, there are still end users out there who blindly click links or follow instructions in that message from ‘Microsoft’ requesting them to change their Office 365 password. One can not always blame the end user; phishers became very crafty in making their deceptions look genuine; even IT professionals often need to look twice to determine legitimacy of a message. For those interested, few months ago Google put a phishing quiz online where you can assess your phishing detection skills.

To assist end users processing inbound messages, many companies have resorted to providing visual clues so end users can more quickly determine the origin of a message or the message being potentially non-legit. One measure often is marking messages originating from outside the organization, by inserting a notice before the contents, or prefixing the subject with something like “[External]”.

Recently, MVP fellow Tony Redmond wrote an article on how to accomplish marking external messages using transport rules in Exchange. For example, to create a transport rule you can use the following cmdlet:

New-TransportRule -Name 'Tag External Mail' -SetHeaderName 'X-ExternalMail-Tagged' -SetHeaderValue 'True' -ApplyHtmlDisclaimerLocation Prepend -ApplyHtmlDisclaimerText '<span style="background-color:yellow;color:black;"><b>Notice</b>: This message originates from outside the organization. Make sure to validate the sender before clicking links or opening attachments.</span>' -ExceptIfHeaderContainsMessageHeader 'X-ExternalMail-Tagged' -ExceptIfHeaderContainsWords 'True' -ExceptIfSenderInRecipientList Allow -FromScope NotInOrganization

The above will create a transport rule that prepends the message with a colored (HTML) notice, inserting a message header to prevent insertion of multiple notices and allowing end users to add senders to their Safe Sender Allow List to bypass tagging messages.

image

However, the problem with these notices is that over time it might make end users insensitive, as messages from external sources are usually large in numbers and become part of the other visual noise like disclaimers and marketing messages. Therefor a better option might be to mark messages which fail DMARC or SPF checks, provided you are not rejecting those messages at some level.

For example, to mark messages failing DMARC or SPF checks, you could create the following transport rule:

New-TransportRule -Name 'Tag DMARCSPFFail Mail' -SetHeaderName 'X-DMARCSPFFail-Tagged' -SetHeaderValue 'True' -ApplyHtmlDisclaimerLocation Prepend -ApplyHtmlDisclaimerText '<span style="background-color:white;color:red;"><b>Warning:</b> The sender of this message could not be validated, and may not be the actual sender.</span>' -ExceptIfHeaderContain
sMessageHeader 'X-DMARCSPFFail-Tagged' -ExceptIfHeaderContainsWords 'True' -ExceptIfSenderInRecipientList Allow -FromScope NotInOrganization -HeaderMatchesMessageHeader 'Authentication-Results' -HeaderMatchesPattern 'dkim=fail','spf=TempError','spf=PermError', 'spf=SoftFail', 'spf=Fail', 'spf=None'

Of course, you could also prepend the subject with a tag to help identifying messages in this category.

More recently, Microsoft added the MailTip feature to Outlook Mobile which also helps in making end users more aware of their communications. After enabling the MailTips for external recipients using:

Set-OrganizationConfig -MailTipsExternalRecipientsTipsEnabled $true

end users will receive a notification when replying to messages outside their organization from Outlook Mobile; Outlook Desktop already had this feature.

Outlook Desktop:
recext

Outlook Mobile:
image

These MailTips are in my opinion the preferred visual clue, as it not only notifies users up front, it also doesn’t clutter message bodies with notifications and warnings.In the end, these notifications are however a small price to pay, compared to the cost of phishing or end users clicking malicious links. It would be nice if Microsoft could already show the MailTip when displaying the message, so it would prevent in accidental clicking of malicious links or attachments.

Note: Advanced Threat Protection (ATP) could of course also help companies with the protection against malicious links and attachments, however not every company has ATP licenses. In both cases, these notices might complement the overall set of measures.