Hello, welcome to the Monday, September 28, 2020 edition of the Sandstone Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

If you're using Exchange Online or if you're thinking about switching to Exchange Online as part of, for example, Exchange 2010, sort of expiring

its extended support. Well, we have a great guest diary for you by Jason Danz. Jason is going

over a lot of details how you can actually secure exchange online. That's something a lot of organizations are having problems with how to essentially

tweak some of these security settings and what they mean, pretty extensive, post, much

larger than what we typically post at the Internet Storm Center with references to various external guides.

So take a look if you are using Exchange Online.

And then we got a quick diary by DDE about how to decode corrupt base 64 strings.

Now, this is mostly about base 64 strings that are missing the padding at the end.

Well, you could just try on error at the padding yourself, just the necessary number of

equal signs, or use a tool that is more forgiving when it comes to padding like DDA's own

base 64 dump tool. And security platform provider Sam Seamless Network has published a blog post

warning of a default certificate problem in 40 Gates''s SSVPN product. Now, Fortygate essentially

states that this is not a real problem. Users should change those certificates. There's also

a warning in the admin interface that basically states you're using default certificates, please go out and get a real certificate for your VPN server.

I feel the warning is sufficient.

Sam Simulus Network disagrees with that and also states that they found over 200 implementations of Fortygate VPN that still use the default certificate.

The problem with the default certificate is that, well, it's signed by Fortygate's internal certificate authority.

Now, probably the larger problem almost here is that clients will happily connect as long as the

certificate is signed by Fortigate or any other trusted certificate authority.

And this actually sort of a little bit of misconception sometimes with some VPN implementations.

...