hello, Recently we discovered some failed authentication requests in the Exchange Transport Logs:
In the attached screenshot you can see that the user name is editor and we receive lot's of entries for different "users". The environment is: Websense --> external firewall -->1 load balancer --> encryption server --> internal firewall -->2 load balancer --> Exchange I believe that the connections originate from the internet because I can see failed authentication errors being reported on the encryption server because it reports that the packets are coming from the 1 load balancer's internal facing IP and because the encryption server works as a smtp proxy it passes the smtp connection towards Exchange. What would be the post place or places to run a Wireshark capture to be sure where the requests are coming from ? It looks to me as someone is trying to hack our Exchange, perhaps smtp auth attack ? Thank you asked 12 Jan '16, 12:48  adasko edited 12 Jan '16, 13:25  sindy |
One Answer:
If I get your drawing right, the SMTP session, if coming from the internet, is encrypted all the way from the internet through to the encryption server, and the encryption server decrypts the incoming messages into plaintext SMTP? If so, Wireshark alone may not be enough, because only the logs of the encryption server can unambiguously disclose to you the correlation between the individual encrypted SMTP sessions coming from the internet and their plaintext counterparts you can see at the "inner" side of the encryption server. Only if the traffic is not too heavy, you might be able to find this correlation based on packets' times of occurrence (or rather tcp session establishment times). And only after you verify that you can find the mapping at the encryption server, one way or the other, it makes sense to run a Wireshark capture at both the "inner" and "outer" interfaces of the 1st load balancer simultaneously with logging or capturing at the encryption server, and use the SSL/TLS payload of the packets "after" and "before" the loadbalancer to find the correlation between the tcp session from the load balancer to the encryption server and its "source" tcp session from the attacker to the load balancer. answered 12 Jan '16, 13:24 sindy |
