Malicious Logins To Zimbra Mail Server
-
I agree that Fail2Ban isn't a good solution for the reasons mentioned.
So that really means you have no other option reasonable option other than trying country blocking as you suggested. Of course that's only so useful, and can come back to bite you since geography based IP is already breaking (just ask Scott).
All of these other options will just show you a failure in another realm. And if the bad guys really want in, they'll just use those call center in india/china to answer captuas like they've been doing for a few years already, so that really won't slow them down.
I think scanning logs for failed is good, now scanning logs for success from outlier IPs might also be good.
-
As I'm working through redacting stuff from this log sample, I'm noticing that most of the auths are coming via IMAP. I'm wondering if I can just disable IMAP externally (block the port at my firewall. Anyone who uses mail outside of our network connects via Exchange (we have Zimbra licensing) or the web interface. At least that's how they should be connecting at any rate. I'll have to talk to my boss. Hmm...
-
You have a front-facing service that has a login prompt. Random automated login attempts are just part of life. What can you do?
-
Setup Fail2Ban. (Smart botnets split the load across lots of IP's).
-
~Geo Blocking~ useless, as bots are all over the place (many in the US)
-
Double Check your password policy (make sure they can't use easily guessable passwords).
-
If you actually have users with highly valuable data in their email, force MDM agents on their mobile devices, if they want to use mobile access Exchange, can be configured to do this. Alternative use a whitelist for remote/mobile devices (Exchange 2010 on has a ActiveSync device quarantine options where devices even if they can authenticate don't get email till you approve them).
-
I've seen it done with AirWatch so only Boxer as a mail client will work as it has a device-specific VPN.
-
Disable unneeded and insecure protocols. IMAP and POP3 shouldn't be externally facing it's 2017...
Lastly, who still uses Zimbra? We used to own it, but now just use O365 (and have Microsoft's billion dollars of security spending and IDS in front of it).
-
-
If you're curious, here is a sample of the login failures via /opt/zimbra/log/audit.log
I also added this to the original post.
-
@storageninja said in Malicious Logins To Zimbra Mail Server:
Lastly, who still uses Zimbra? We used to own it, but now just use O365 (and have Microsoft's billion dollars of security spending and IDS in front of it).
Obviously you have no need to be in this thread, then. I'm looking for suggestions on mitigating my existing services from the current threat. Not, "who uses this crap these days?"
-
As @StorageNinja said, there is really no way to stop this. If they're smart enough to throttle attempts, they're smart enough to set up bots to do this. Blocking IPs won't do anything. 2FA is the best way to handle it. Certs on the devices, OTPs, etc.
-
@dustinb3403 said in Malicious Logins To Zimbra Mail Server:
2FA is likely the best approach, and the most simple to manage.
No, not having public access at all is the "best" approach from a security standpoint.
-
@coliver said in Malicious Logins To Zimbra Mail Server:
Why wouldn't you use Fail2Ban? This seems like this is exactly what that system was designed to do.
I agree, we always use that.
-
@anthonyh said in Malicious Logins To Zimbra Mail Server:
@coliver said in Malicious Logins To Zimbra Mail Server:
Why wouldn't you use Fail2Ban? This seems like this is exactly what that system was designed to do.
Yes, but the way these attempts are formed it would take days for an IP to even be considered to be blocked. Our users fat-finger their passwords much quicker than that :-D, so I think it would block our users more than the bad guy. I would need to set the failed time frame to like a week in order for it to be useful.
Is this attack over SSH or IMAP or web?
-
@storageninja said in Malicious Logins To Zimbra Mail Server:
- ~Geo Blocking~ useless, as bots are all over the place (many in the US)
And it isn't accurate. I get detected as the wrong country almost 100% of the time. Something about people on Frontier's FiOS show up as Toronto.
-
@scottalanmiller said in Malicious Logins To Zimbra Mail Server:
@coliver said in Malicious Logins To Zimbra Mail Server:
Why wouldn't you use Fail2Ban? This seems like this is exactly what that system was designed to do.
I agree, we always use that.
Well, I wasn't saying not to use it. I was saying that I don't think it would be effective in this scenario.
-
@storageninja said in Malicious Logins To Zimbra Mail Server:
Lastly, who still uses Zimbra? We used to own it, but now just use O365 (and have Microsoft's billion dollars of security spending and IDS in front of it).
Actually find it better than O365. We use it and the more we use it, the more we stop using O365. Faster, easier, more accurate.
-
@anthonyh said in Malicious Logins To Zimbra Mail Server:
@scottalanmiller said in Malicious Logins To Zimbra Mail Server:
@coliver said in Malicious Logins To Zimbra Mail Server:
Why wouldn't you use Fail2Ban? This seems like this is exactly what that system was designed to do.
I agree, we always use that.
Well, I wasn't saying not to use it. I was saying that I don't think it would be effective in this scenario.
Still, start with it. At least let it do its jobs in that regard.
-
@scottalanmiller said in Malicious Logins To Zimbra Mail Server:
@anthonyh said in Malicious Logins To Zimbra Mail Server:
@coliver said in Malicious Logins To Zimbra Mail Server:
Why wouldn't you use Fail2Ban? This seems like this is exactly what that system was designed to do.
Yes, but the way these attempts are formed it would take days for an IP to even be considered to be blocked. Our users fat-finger their passwords much quicker than that :-D, so I think it would block our users more than the bad guy. I would need to set the failed time frame to like a week in order for it to be useful.
Is this attack over SSH or IMAP or web?
Appears to be IMAP (which will be blocked publicly shortly). We do not have SSH open publicly.
-
@storageninja said in Malicious Logins To Zimbra Mail Server:
- Disable unneeded and insecure protocols. IMAP and POP3 shouldn't be externally facing it's 2017...
Right, should be IMAP/S. But the issue remains.
-
I'm going to echo @StorageNinja's comments about POP3 and / or IMAP -- disable them and force folks to use the ActiveSync setup and/or the Webmail.
Edit: Easy way to test this is to block IMAP & POP at the firewall for a few hours and see who screams, lol.
-
@dafyre said in Malicious Logins To Zimbra Mail Server:
I'm going to echo @StorageNinja's comments about POP3 and / or IMAP -- disable them and force folks to use the ActiveSync setup and/or the Webmail.
Does that solve anything? Same issues.
-
@scottalanmiller said in Malicious Logins To Zimbra Mail Server:
@dafyre said in Malicious Logins To Zimbra Mail Server:
I'm going to echo @StorageNinja's comments about POP3 and / or IMAP -- disable them and force folks to use the ActiveSync setup and/or the Webmail.
Does that solve anything? Same issues.
One less attack vector I suppose. They could still hammer the web interface.
-
@scottalanmiller said in Malicious Logins To Zimbra Mail Server:
@dafyre said in Malicious Logins To Zimbra Mail Server:
I'm going to echo @StorageNinja's comments about POP3 and / or IMAP -- disable them and force folks to use the ActiveSync setup and/or the Webmail.
Does that solve anything? Same issues.
Mainly it disables two old and insecure protocols. So no, it doesn't solve anything, but it makes things ever so slightly more difficult for the hackers (how long does it take them to switch from IMAP/POP to ActiveSync?).
-
@dafyre said in Malicious Logins To Zimbra Mail Server:
@scottalanmiller said in Malicious Logins To Zimbra Mail Server:
@dafyre said in Malicious Logins To Zimbra Mail Server:
I'm going to echo @StorageNinja's comments about POP3 and / or IMAP -- disable them and force folks to use the ActiveSync setup and/or the Webmail.
Does that solve anything? Same issues.
...(how long does it take them to switch from IMAP/POP to ActiveSync?).
I will be able to tell you soon.
