Security Manager's Journal: Not-so-innocent email distribution lists
- 19 November, 2012 14:52
Is everything a potential security vulnerability? Is there nothing that a security manager shouldn't look at with suspicion?
At issue: A phishing attack gets through to 900 users on a single email distribution list.
Action plan: Find out how many email distribution lists are externally available.
What, for example, could seem more innocent than an email distribution list? Such lists are convenient and ubiquitous, and in a company of any size at all, indispensable. They let you send an email to everyone in, say, marketing, by just putting the name of the marketing group in your email's "to" field. You don't have to worry about leaving anyone out, as long as your company's Exchange or Notes administrator sees to it that the lists are kept up to date. They certainly don't seem suspect.
Last week, however, distribution lists were implicated when we looked into something that turned out to be a rather brazen phishing expedition.
It started with the help desk receiving emails from several employees complaining that they were unable to access our company's payroll website and that they had gotten emails stating that either the certificate used to access the payroll site had expired (and they needed to click on a link to validate the certificate) or the password for the site had expired (and they needed to log in to change the password). That sounded like phishing to me, and sure enough, when I moved my curser over the link in the email, a very different Web address was displayed.
Wanting to know more, we investigated the link. What we found was that any user who had done the same was encouraged to install a file. We then downloaded the file in a secure environment for forensic analysis and identified it as a piece of malicious software for connecting to a site in China. It looked as if the idea was to trick unsuspecting users into making their PCs available to a command-and-control network operated out of China. Fortunately, our endpoint protection client is able to detect the software and prevent it from executing. Unfortunately, at any given time, about 6% to 7% of our desktops are not protected or haven't been updated with the proper pattern files, so there is the possibility that some machines on our network are now zombies.
But what does any of this have to do with distribution lists? Well, the phishing email was sent to an externally available distribution list with more than 900 users. That made it easy for us to determine which machines might be compromised, so we'll be able to check each one and make sure it has the proper endpoint protection client installed.
Rein In Those Lists
There was no good reason for this distribution list to be externally available. That led me to ask our email administrators how many of our distribution lists are configured similarly. The answer was astonishing: We have more than 3,000 distribution lists (and just 4,000 employees, mind you), and more than 400 of them are externally available. I can't see any reason why our external partners would need more than 20 or 30 lists. Clearly, we have a process problem.
In fact, some of our help desk staffers have been marking distribution lists as externally available by default. They will be educated to do otherwise. We are also going to audit all of the externally available lists and eliminate any for which there is no business justification. From now on, no distribution list will be externally available without my approval.
To ensure compliance, I'm having our security analyst investigate whether we can use our security incident and event management tool to alert us when a newly created distribution list is marked as "externally available." I've also asked our email administrators to investigate why our external spam-filtering service didn't protect us from this attack. And finally, this is a great opportunity to send out a global email to warn everyone about phishing attacks and provide tips on how to spot one.
This week's journal is written by a real security manager, "Mathias Thurman," whose name and employer have been disguised for obvious reasons. Contact him at email@example.com.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
Larry Page wants to see your medical records
Dual-Persona Smartphones Not a BYOD Panacea
After two-year hiatus, EFF accepts bitcoin donations again
CIOs struggle to deliver timely mobile business apps: survey
Spiceworks' free management software gets integrated MDM
Benefits of Deploying Microsoft Exchange Server 2010 on Dell Compellent with Data Progression
Messaging and collaboration platforms have emerged as mission critical applications, consuming a large portion of IT spending for organisations. The rich features in these applications have significantly changed the messaging requirements and needs of today’s information from anywhere with any device, the result is an ever increasing demand on storage systems both in terms of capacity and bandwidth. Many organisations are rethinking their storage strategies to meet the demanding criteria and to handle the future requirements. Read more.
Android Malware Exposed
Take an in-depth look at the evolution of android malware. The world of malware targeting the Android OS is similar yet very different from malware affecting Windows. Explore the rapidly evolving world of android malware and shed light on the various techniques used to exploit devices using this OS.
Staying Ahead of the Data Explosion
The total volume of data being processed and stored by businesses is rising exponentially. IDC has estimated that the size of the "digital universe" will increase 29 fold between 2010 and 2020. Data storage technology has undergone a steady increase in capacity, along with a steady decline in the cost per unit to store information. Unfortunately, data storage capacity is not keeping pace with data growth and necessitating greater intelligence in the storage infrastructure. Read more.