First Enterprise Cloud that adjusts to your budget

At MTNLCloud, we deal with a lot of phishing email attempts. These are the usual robber-and-cop routines where the bad guys think of new tactics and we  block them.

This week, we saw something that just blew us away. Last week, some of our clients received emails as follows:

At first sight, we told them to ignore such emails as these are mostly shot in the dark. There will certainly be a small percentage of people who have done something they want to hide and would pay up. That would be enough earnings for these Phishers for their efforts.

However,  we were shocked by the additional information customers provided:

1. The password given in XXXXXXXX was correct.
2. The password belonged to their Facebook account.
3. Some of them have not used their Facebook account for years.

We also found that all such emails originated from an Outlook account and it came right out of Outlook email service.

No service provider worth their salt stores password in plain text. These emails gave the correct password in plain text. This means there is a breach on the client side (say Facebook app) or on the server side (God forbid!).

While we are in no position to find out how or why, we thought we will post this to spread the awareness.

1. If you receive such an email, do not panic.
2. Use a fresh computer (possibly a new one) and change your Facebook password.
3. Never even think of paying up (irrespective of whether you have something to hide or not). Phishers usually reel you in and then keep increasing the amounts. They are complete fraudsters and you can never trust their word.

The implication that some third party can send you an email with your password itself is very unsettling. And the fact is that some of the users who received such emails have not used their accounts for years!

Whether you have received such an email or not go ahead and change your Facebook password. We did!

 

When MTNLCloud took over responsibility for email addresses of @mtnl.net.in in Aug 2016, several security mechanisms were put in place.

• The first one was to close port 25 for all broadband clients and asking clients to switch to a different port for sending emails, or use the relay service provided by MTNL. This by itself was a major change. Overnight, SPAM originating from Bots and Zombies in Mumbai broadband stopped.
• An outbound Anti SPAM, first of its kind in the world, was implemented.
• Anti SPAM system was revamped which not only catches SPAM, but provides good intelligence on the activity of SPAMmers.

These have made MTNLCloud Email service one of the most secure in India and possibly in the world.

The Anti SPAM system has revealed that there is an army of hackers who constantly try to get through the email system by using Phishing. They prey upon email users and try to extract passwords as well as try to inject Malware into the email users system.

One of the common mechanism is to send emails as MTNLCloud Administrator and trying to get the user to enter their password in an unauthorized web page. Then this password is mis-used to send SPAM. These emails use a wide variety of psychological tricks, including

• offering free upgrades,
• threatening to cancel the account,
• threatening to cancel unless the account is verified, etc.

In here, we share some samples of attempted SPAM so that users can recognize it for what it is (if at all they receive it). These SPAM are blocked by MTNLCloud Anti SPAM system, but was made available to Administrators for analysis.

We will post a screen shot of the email as well as information on how it was sent. We will aggregate about 10 of these emails and post them in an article as and when possible.

When the World Wide Web was launched, Internet was still in a nascent stage. General trust level was high and application development was just about implementing the application logic. Security was one of the last checks done by the QA guys. The average developer could hardly be concerned with Security.

Internet has come a long way since then. When you activate a web application on the Internet, it gets scanned for vulnerabilities even before the site goes to Alpha. If you are a developer who ignores security, chances are that you will not keep your job.

Solutions have come to tackle the security issues. Some have stayed on and some have gone away.

With web applications, anything that an user does in a browser can be automated. This means that one can write a program to access information from a web site. Incidentally, this is the way most of the search engines work. They have programs that scan the web site and index the information in them for searches.

This ability can also be misused to

• Crack passwords using brute-force method. Programs can try out of 100’s of password per second to guess a password and once the same is found, unauthorized access can be got.
• Make web sites less efficient. Using a program, one can make a lot of requests. This will make the site sluggish and genuine users will be put off with slow response.
• Copy information. It might take weeks for you to do research and update the information on your web site, but will take just seconds for some one to copy it.

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) was proposed as a solution to prevent misuse. In this method, whenever any part of the web site information is to be protected from programs,  an image like the one below is presented to the user.

User is expected to enter the number in a separate input box and if it matches, access to information is provided. Computers (in spite of the much hyped talk about AI), find it tough to do simple task like identifying the numbers in the above image and therefore this puts a big road block for automated programs.

CAPTCHA did its work and many web sites adopted the same.

While the initial idea was good, there was a section of users who subscribed to the idea that more difficult CAPTCHA, more effective it is. There were theories floating around of some CAPTCHA being broken and this lead to a rush for making CAPTCHA more complicated.

The images were distorted, color variations made too bizarre that it became even difficult for even humans to read CAPTCHA. In addition, in the name of Innovation, puzzles like

• How much is 5+6?
• Click on all pictures with a Road sign

were put in, complicating the entire process. I remember the time when US style road signs were displayed in the image and people here were just not able to complete the CAPTCHA.

What started out as a promising solution was on its way to being a nuisance for genuine Web users.

MTNLCloud Implementation

Early in the implementation of MTNLCloud, we decided to re-look at CAPTCHA process. In any web application, there are two parts

• Client part, which runs on the user browser (using Javascript), and
• Server part, which runs on the server.

Application security is pretty much decided by the server security in place. So instead of relying on CAPTCHA, we decided to implement a Rate limiter at the server level for the application. The rate limiter will

• Block requests that exceed certain number per minute.

This solves all the problems that CAPTCHA solves. If an automated program sends lot of requests, they effectively get no information or at best get patchy and wrong information. Combined with client side validation of input, this clinched the issue.

We do have a simple CAPTCHA, consisting only of numbers, in single color and with no complicated image manipulation to thwart script kiddies.

So far it has been holding up fine and we have not seen a single wrong entry of CAPTCHA. Keep checking this section for further updates.