{"id":314,"date":"2022-01-31T22:17:00","date_gmt":"2022-01-31T09:17:00","guid":{"rendered":"https:\/\/www.howdoiuseacomputer.com\/?p=314"},"modified":"2022-02-01T00:22:54","modified_gmt":"2022-01-31T11:22:54","slug":"is-your-hybrid-exchange-server-safe-or-unknowingly-exposed","status":"publish","type":"post","link":"https:\/\/www.howdoiuseacomputer.com\/index.php\/2022\/01\/31\/is-your-hybrid-exchange-server-safe-or-unknowingly-exposed\/","title":{"rendered":"Is your Hybrid Exchange Server SAFE or unknowingly EXPOSED?"},"content":{"rendered":"\n
Hello and happy 2022! 🥳 I hope the year has started off as well as it possibly can for you (aside from the holiday ending a bit too early of course!)… 🍺😭 …right back to work! <\/p>\n\n\n\n
Now, is your Exchange environment safe!!??<\/strong> Really? Is it?<\/strong><\/p>\n\n\n\n
I love this utility called \u2018SMTP Diag Tool\u2019. It\u2019s great for seeing whether you can connect directly to port 25 of an Exchange server. In most cases, if you can, you can send unauthenticated email to accepted domains within the organisation, because that’s how email used to work right?<\/p>\n\n\n\nSMTP Diag Tool<\/figcaption><\/figure>\n\n\n\n
Before we had a mail filtering service in front of Exchange, email was sent directly between servers (in fact if Exchange was configured to use SpamHaus and SpamCop lookups, it did a pretty good job itself!). But I digress…<\/p>\n\n\n\n
In many cases lately I have found I can connect directly to, and send unchecked email to Exchange servers, most often using ‘mail’ or ‘webmail’ hostnames. This method bypasses MX records, mail filtering services and also tells you probably have port 443 wide open as well. Clients are shocked – bypassing my mail filter – really? Yep! Here are the scenarios:<\/p>\n\n\n\n
You have a mail filtering service<\/strong>, but nobody set up the firewall or Exchange rules to restrict inbound email to the services sending IP Addresses (applies to on-premises and 365).<\/li>
You have a Hybrid Exchange configuration<\/strong>, some or all mailboxes are in the cloud but you still have port 25 and 443 open to your on-premises server.<\/li>
And a less serious case but a definite gap to plug <\/strong>– you are cloud only or hybrid, but have not configured rules to stop other tenants from emailing you directly (this would need to be a targeted attack, but I’m sure the attackers will automate the creation of that attack in future if not already).<\/li><\/ol>\n\n\n\n
To fix this<\/strong> there are several options; the more configured the better!<\/p>\n\n\n\n
The best step to take is restricting incoming traffic at the firewall. <\/strong>If you can’t use ‘Internet databases’ as firewall objects, throw away your firewall and get a suitable FortiGate model. <\/li>
Use the ‘Microsoft-Azure’ and ‘Microsoft-Outlook’ objects <\/strong>to restrict incoming (and outbound if you can) 25 traffic to Microsoft’s servers (if you are hybrid and using Defender mail filtering) OR<\/strong> by restricting to your mail filtering service’s IP range for port 25 (if you are on-premises, or routing through it).<\/li>
Use the Exchange Hybrid Agent! <\/strong>Re-run the wizard and choose the Agent option (you may need to install it manually first if running 2010). This allows you to close port 443 inbound entirely,<\/strong> by performing free \/ busy lookups and mailbox moves through an Azure App Proxy.<\/li>
For port 443<\/strong>, you can also use an Azure Application Proxy<\/strong> to act as a gateway to your environment if you are not Hybrid and it must be contactable from the internet (IMO Everyone <\/strong>should be using this for internet facing services – then you can close all inbound ports on your firewall and let Microsoft do the work!! (security team = ✅)<\/li>
If you do have inbound 443, use IIS with the URL Rewrite <\/strong>module to block access to any virtual directories that are not required (you’re not still using ActiveSync I hope!!?). <\/li>
You can also <\/strong>modify the Default Receive Connector <\/strong>in Exchange only to accept from a filtering service, or 365, but this is harder to maintain and shouldn’t be needed if the firewall is configured correctly.<\/li>
![\"\"](\"https:\/\/www.howdoiuseacomputer.com\/wp-content\/uploads\/2022\/01\/image.png\")