Hello, welcome to the Friday, August 21st, 2020 edition of the Sandsen and Stormers Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

One of the issues that came up during the Sands Data Incident this month was Outlook 365 forwarding rules. And essentially what the attacker

did here was add forwarding rules in order to receive copies of certain emails. And this is a technique

that has been used quite regularly in particular in the realm of business email compromise attacks.

What reason Sands was able to detect this particular attack was auditing of those mail forwarding rules.

And today Rob has a power shell script for you to do so relatively easily.

And if you're saying that, hey, it's probably way too many of these rules to really figure out what's legit, what's not legit, you have to start somewhere.

And of course, what you will be looking for going forward is any changes to those rules.

And that may give you a hint as to where to look first.

And talking about email, one common problem, of course, with email is that it's difficult for the user to discern the actual source of an email.

Now, over the years, there have been some automated protocol. to discern the actual source of an email.

Now, over the years, there have been some automated protocols to make it easier for mail servers to classify spoofed email, for example, SPF, and DMARC.

But apparently Google had an interesting bug that allowed you to bypass these policies for G Suite and Gmail users.

The problem here was twofold.

First of all, it is possible to forward an email to an arbitrary recipient.

Now, similar features often require that you first verify that you own the receiving

email address, but not so with Gmail. In addition, it was possible to specify an incoming

mail server which you trust, which of course, as Google described, is often used for initial filters

like spam filters and the like. So you can actually set up a certain mail server and then

this mail server will be trusted by Gmail. So any email will be accepted from this mail server. Of course, the downfall here is that then you can

forward this email using the feature I mentioned first, and the combination of these two features

...