TESTING SMTP AUTH USING TELNET

Test if SMTP authentication is working.

Sometimes you need to test SMTP Authentication is working on your server, and you may not have Outlook or another email client handy to test the connection.

You can verify SMTP authentication is working by using telnet and accessing the SMTP server directly. Below is a quick tutorial on how to test your server with Atmail for SMTP authentication details.

RESOLUTION

1. First, make sure SMTP authentication is enabled via the Atmail Webadmin > Services > SMTP Settings > SMTP Authentication = On
2. Next, create or verify an existing username and password on the system
3. Build the Base64 username/password
   SMTP AUTH LOGIN will encapsulate the username and password as a Base64 string. This is used to prevent sending the username/password plaintext via the network connection. Using Perl, you can issue the following command to encode the username and password as a base64 string, which can be sent to the SMTP server. Note the @ symbol is escaped to pass the string via Perl.
   

   # perl -MMIME::Base64 -e 'print encode_base64("myusername\@domain.com")'
   bXl1c2VybmFtZUBkb21haW4uY29t
   # perl -MMIME::Base64 -e 'print encode_base64("weakpass")'
   d2Vha3Bhc3M=

4. Access the local system. Commands we issue are highlighted in bold.
   

   # telnet localhost 25
   Trying 127.0.0.1...
   Connected to localhost.localdomain (127.0.0.1).
   Escape character is '^]'.
   220 mydomain.com Welcome to the @Mail SMTP Server ( Exim )
   ehlo test.com
   250-mydomain.com localhost [127.0.0.1]
   250-SIZE 52428800
   250-PIPELINING
   250-AUTH LOGIN
   250-STARTTLS
   250 HELP>

   The above command will verfiy AUTH LOGIN is enabled on the server. Next, send the following command to start the SMTP Authentication process.
   

   AUTH LOGIN
   334 VXNlcm5hbWU6 ( Server returns username as a base64 string )
   bXl1c2VybmFtZUBkb21haW4uY29t
   334 UGFzc3dvcmQ6 ( Server returns password as a base64 string )
   d2Vha3Bhc3M=
   235 Authentication succeeded

5. Congratulations, SMTP authentication is now enabled and confirmed working on your server. Note you must send the Base64 string of the username and password as two commands.

Millions of recent laptops will stop receiving new features and aniversary update

Laptops running on Intel Atom 'Clover Trail' chipsets will not receive any Windows 10's feature updates post the Anniversary Update, issued in summer last year.

Microsoft has confirmed that millions of recent laptops will no longer receive updates to add new features to Windows 10.
Laptops running on Intel Atom 'Clover Trail' chipsets will not receive any Windows 10's feature updates post the Anniversary Update, issued in summer last year.
Despite most of these machines only being three or four years old, Microsoft says it is unable to push these updates to 'Clover Trail' laptops, due to Intel ceasing support for the chipset.
Machines that will no longer receive these updates include those running on Intel Atom Z2760, Z2580, Z2560 and Z2520 processors, such as the HP Envy X2 laptop. Reports say that at least 10 million of these devices were sold in 2013 and 2014, according to analyst estimates.

Ahead of the launch of Windows 10, Microsoft's executive VP of the Windows and Devices Group Terry Myerson said: "Once a Windows device is upgraded to Windows 10, we will continue to keep it current for the supported lifetime of the device - at no cost. With Windows 10, the experience will evolve and get even better over time."

"If a hardware partner stops supporting a given device or one of its key components and stops providing driver updates, firmware updates, or fixes, it may mean that device will not be able to properly run a future Windows 10 feature update," says a Microsoft spokesman.

While feature updates will not be forthcoming, Microsoft has pledged to continue issuing security patches to these machines until January 2023, the end of the original Windows 8.1 extended support period.

Source & further info: TechRepublic

Petya ransomware

The Petya ransomware attack that crippled computers in 64 countries worldwide was spread by accounting software, according to Microsoft, highlighting the dangers posed by compromised third-party apps.
The outbreak started in Ukraine, where more than 12,500 machines were infected, and there is now evidence this new Petya malware variant was initially spread via an updater for the tax accounting software MEDoc.

 A large number of organizations were infected, many in Ukraine, including Danish transport company Maersk, Russian oil firm Rosneft, the Kiev metro system, National Bank of Ukraine, the law firm DLA Piper, US pharmaceutical company Merck and many others.

How to protect yourself

Once the ransomware infects a machine, it then attempts to spread itself to other PCs on the network. To propagate itself, it will try to steal credentials to gain local admin privileges, attempt to use file-shares to transfer the malicious file between PCs, and then remotely execute the file. The ransomware encrypts entire hard drives and demands a Bitcoin payment of $300 to release them.
The malware can also spread itself using the EternalBlue exploit for an SMB vulnerability, which was used by WannaCry to spread between machines. The vulnerability was patched by Microsoft in March this year.
Microsoft recommends applying this security update, but for those who aren't able to, it suggests firms "disable SMBv1 with the steps documented at Microsoft Knowledge Base Article 2696547" and "consider adding a rule on your router or firewall to block incoming SMB traffic on port 445".
Another workaround for blocking infection by Petya is to create an extensionless, read-only file called perfc in the C:\Windows folder, using the steps outlined here.
Microsoft also provides a detailed a breakdown of commands and network activity that indicate a Petya infection.


Other reports say that the provider of the email address shown to receive the ransom closed it down, deactivated it so there's no way to pay or ask decryption of your data from the attacker.

While steps were taken to be able to block the attack in your pc, so far there's no 'kill switch' to stop the virus from spreading.

Ofcourse the known story still comes up: "keep you windows machine" updated with security updates and also have a good antivirus solution to protect yourself like the one we offer.

Source: Techrepublic

installing Ubuntu 17.04 with encrypted home makes boot delays

the problem is when installing Ubuntu with encrypted home, 17.04 creates a swapfile instead of a swap partition like previous versions, then the installer writes a faulty config file.

In particular, ecryptfs-setup-swap puts in /etc/crypttab a line like this:

cryptswap1 UID=XXXXXXXX /dev/urandom swap,offset=1024,cipher=aes-xts-plain64


(like there were a swap partition with UID=XXXXXXXX) while with a swapfile it should put the following line:

cryptswap1 /swapfile /dev/urandom swap,offset=1024,cipher=aes-xts-plain64

If you manually change that line and reboot, you get rid of the problem - before rebooting, check also that your /etc/fstab file ends with:

/swapfile               none  swap  sw  0  0
/dev/mapper/cryptswap1  none  swap  sw  0  0

---

Because of this error Ubuntu spends a long time waiting for the swap.

“WannaCry” Ransomware

a ransomware attack has emerged that is worthy of tears. WannaCry ransomware has hit the scene, spreading like wildfire across 150 countries and infecting more than 250,000 machines, which includes a massive takedown of 16 UK NHS medical centers in just one day. Other major countries impacted include Spain, Russia, Ukraine, India, China, Italy, and Egypt.

Now, how is this massive attack possible? The ransomware attack exploits the Server Message Block (SMB) critical vulnerability–also known as the Equation Group’s ETERNALBLUE exploit, part of the FuzzBunch toolkit released by Shadow Brokers a couple of weeks ago. Basically, the attacker can use just one exploit to gain remote access into a system. Once access is gained, the cybercriminal then encrypts data with a file extension “.WCRY.” Not to mention, the decypter tool used can hit users in multiple countries at once, and translate its ransom note to the appropriate language for that country. The ransom is said to demand $300 to decrypt the files.

The good news is, consumers don’t have to worry about this attack affecting their personal data, as it leverages a flaw within the way organizations’ networks allow devices to talk to each other.

However, this attack does act as a reminder for consumers to prepare for personal ransomware attacks. In order to stay prepared and keep your personal data secure, follow these tips:

-Be careful what you click on. This malware was distributed by phishing emails. You should only click on emails that you are sure came from a trusted source. Click here to learn more about phishing emails. 

-Back up your files. Always make sure your files are backed up. That way, if they become compromised in a ransomware attack, you can wipe your disk drive clean and restore the data from the backup.

-Update your devices. There are a few lessons to take away from WannaCry, but making sure your operating system is up-to-date needs to be near the top of the list. The reason is simple: nearly every software update contains security improvements that help secure your computer and removes the means for ransomware variants to infect a device.

–Schedule automatic updates. It’s always a good practice to set your home systems to apply critical Windows Security Updates automatically. That way, whenever there is a vulnerability, you receive the patch immediately.

–Apply any Windows security patches that Microsoft has sent you. If you are using an older version of Microsoft’s operating systems, such as Windows XP or Windows 8, click here to download emergency security patches from Microsoft. 

–Keep security solutions up-to-date. 

source: McAfee

Tips to keep your online accounts secure

If you didn't know, the first Thursday in May of each year has been officially declared World Password Day—a day to promote good security hygiene and password habits. In 2017, that day has fallen on May 4.

Here's a simple four-step approach to better passwords:

1. Create strong passwords

Strong passwords, according to the World Password Day website, have at least eight characters, with a mix of uppercase letters, lowercase letter, numbers, and symbols. They also avoid the use of personal information, such as birthdays or middle names.

2. Use a different password for each account

Using a different password for each online account is important because, if you share passwords across accounts, one compromised password can be used to log into another account. This is especially important regarding online banking and financial accounts.

3. Get a password manager

Password managers, like LastPass or 1Password for example, can help you store multiple passwords, often in an encrypted manner, for easy access. Typically, they will require one master password with additional layer of authentication to access the stored passwords.

4. Turn on multi-factor authentication

Multi-factor authentication adds an additional layer of security on top of your standard password. For example, an app may require you answer a security question, input a unique code, or use a fingerprint scanner on top of using your password. Check the security settings of your favorite apps and passwords to see if multi-factor authentication is available.

Source: TechRepublic

Companies still fail security basics, as ransomware rises

Most breaches take advantage of simple passwords

Companies are still failing to take basic steps to secure their businesses, a new report has found.

Verizon's annual Data Breach Investigations Report, published today, revealed that of the almost 2,000 breaches and security incidents that were analysed, a whopping 81% used easily-guessed or stolen passwords.

Furthermore, over 65% of malware infections were delivered via email attachments - a technique that has been around for decades. Pretexting - a form of social engineering used to obtain privileged information - is also on the rise.

With so many enterprises falling victim to age-old tactics, why are businesses still failing to take basic security measures like strong password hygiene and regular data backups?

"It's a very good question, and it's one we ask ourselves on a recurring basis," Verizon's director of international security solutions, Ali Neil, told IT Pro, "because this is not the only year that we find that the human vector is probably the most susceptible, and theoretically the easiest one by which to combat things."

"You don't have to pay a fortune for a SIEM solution or an intrusion detection solution, you actually have to enforce some basic standards," he added. "Our message is that training is the simplest thing you can do with people."

Not everyone agrees, however. Bromium's EMEA CTO, Fraser Kyne, said that companies need to spend less time focusing on employee training, not more.

"What most interested me in this year's report was that phishing attacks are actually becoming even more prevalent," he said. "One in 14 users are being duped into clicking on a bad link or attachment; but even worse, a quarter of those people go on to do it again. There is a phrase that I think is very apt here - "You can't patch stupidity'.

"Organisations therefore need to shift the onus away from controlling user behaviour if they are to get a handle on the situation. The best way of mitigating phishing attacks is to have a safety net in place, allowing end users to click with freedom, without having to worry too much about stumbling upon a bad link or malicious attachment."

The report included further interesting findings, such as the fact that organised crime gangs were behind more than half of all breaches, almost 70% of all threats to healthcare come from within the organisation, and around 50% of attacks on educational institutions were perpetrated by state-affiliated hackers.

Unsurprisingly, ransomware has also gone up by 50% compared to last year's report. Across the numerous reports put out by the security industry, a consistent rise in ransomware activity is one of the universal constants.

Source: ITPRO