{"id":3531,"date":"2022-10-04T03:00:10","date_gmt":"2022-10-04T02:00:10","guid":{"rendered":"https:\/\/www.sebae.net\/blog\/use-authentication-policies-to-fight-password-spray-attacks\/"},"modified":"2022-10-04T03:00:10","modified_gmt":"2022-10-04T02:00:10","slug":"use-authentication-policies-to-fight-password-spray-attacks","status":"publish","type":"post","link":"https:\/\/www.sebae.net\/blog\/use-authentication-policies-to-fight-password-spray-attacks\/","title":{"rendered":"Use Authentication Policies to Fight Password Spray Attacks"},"content":{"rendered":"
\n

We have recently seen several indicators that show that many of our customers are being targeted by password spray attacks that leverage basic authentication.<\/p>\n

The only<\/em> reason we\u2019re turning off basic auth in Exchange Online is to protect your users and data. The evidence I see every day clearly indicates that password spray attacks are becoming more frequent.<\/p>\n

If basic auth hasn\u2019t yet been turned off<\/a> for your tenant, or if you\u2019ve asked for more time, you should read this.<\/p>\n

What is a Password Spray attack?<\/span><\/h2>\n

A password spray attack is a type of brute force attack in which the attacker tries a large number of usernames with a list of common passwords against a target system to see if any will work. It\u2019s often hard to detect as the username keeps changing; accounts don\u2019t get locked because the account being attacked changing. Attackers also distribute their efforts over their targets and keep changing their source IP.<\/p>\n

It’s a numbers game essentially, and computers are quite good at numbers. And as attacks go, it works<\/em>.<\/p>\n

The most popular protocols we see attacked like this are SMTP and IMAP. POP is third on the list, but SMTP and IMAP are way out there in a league of their own.<\/p>\n

What can you do about this?<\/span><\/h2>\n

Set up Exchange Online Authentication Policies to ensure only the accounts that you know should be using basic auth with specific protocols, can use basic auth with these protocols. Start with SMTP and IMAP and do it today!<\/p>\n

How do you set up Authentication Policies?<\/span><\/h2>\n

Our documentation<\/a> is rather good at answering this question, and there are many other docs out there written by MVPs<\/a> and other community contributors. Rather than explain the actual step by step, I wanted to explain the strategy.<\/p>\n

We\u2019ll use IMAP as the example, and then repeat for each protocol, noting that some apps (such as Outlook) use more than one protocol. So, you might need some \u201ccombination\u201d policies as users can only have one policy assigned:<\/p>\n