SharePoint

New Phishing Scam Using Microsoft Office 365

*** Attention Required ***

It seems that the bad guys are at it once again with an attempt to collect information by phishing credentials from those of us using Office 365 for corporate emails.  The characteristics of this particular attack the hackers intention is to deceive Office 365 users into providing their login credentials”.

The user sees a fake Office 365 login page, which requests their credentials. Once the Office 365 usernames and passwords have been compromised, the hackers can:

  • Send emails to other users in the victim’s address book, asking them for anything, sending fake invoices, sending more phishing emails, etc.
  • Access the user’s OneDrive account, to download files, install more malware, infect files with malware, etc.
  • Access the users SharePoint account, to download files, install more malware, etc.
  • Steal company intellectual property or other customer information such as customer SSNs, credit card numbers, email addresses, etc.

One of the characteristic of this recent attack is an email being sent with an embedded image which resembles an Microsoft Office Word document containing a link back to a site with a fake Office 365 logon page.  In addition to this the site URL ends in php?userid= syntax.

I have provided the following YouTube video to illustrate the interaction of the fake Office 365 logon page.

Link: https://youtu.be/wHxkzxGF4JY

 

Advice:

It’s an important part of your responsibility to be cautious when accessing emails even from known senders to ensure its legitimate by reviewing the email to ensure that its legitimate.

If in doubt do not open the email and reach out to the sender to ensure they sent you the email.  If you self-determine an email to be suspicious immediately report incidents as soon as they happen.

 

Here are a few guidelines below that could be followed.  Please review:

 

Check the sender.

Sometimes, cybercriminals and hackers will fake (or “spoof”) the sender of an email. If the “from” address doesn’t match the alleged sender of the email, or if it doesn’t make sense in the context of the email, something may be suspicious.

Check for (in)sanity.

Many typical phishing emails are mass-produced by hackers using templates or generic messages. While sophisticated attacks may use more convincing fake emails, scammers looking to hit as many different inboxes as possible may send out large numbers of mismatched and badly written emails. If the email’s content is nonsensical or doesn’t match the subject, something may be suspicious.

Check the salutation.

Many business and commercial emails from legitimate organizations will be addressed to you by name. If an email claims to come from an organization you know but has a generic salutation, something may be suspicious.

Check the links.

A large number of phishing emails try to get victims to click on links to malicious websites in order to steal data or download malware. Always verify that link addresses are spelled correctly, and hover your mouse over a link to check its true destination. Beware of shortened links like http://bit.ly, http://goog.le, and http://tinyurl.com. If an email links to a suspicious website, something may be suspicious.

Don’t let them scare you.

Cyber criminals may use threats or a false sense of urgency to trick you into acting without thinking. If an email threatens you with consequences for not doing something immediately, something may be suspicious.

Don’t open suspicious attachments.

Some phishing emails try to get you to open an attached file. These attachments often contain malware that will infect your device; if you open them, you could be giving hackers access to your data or control of your device. If you get an unexpected or suspicious attachment in an email, something may be suspicious.

Don’t believe names and logos alone.

With the rise in spear phishing, cybercriminals may include real names, logos, and other information in their emails to more convincingly impersonate an individual or group that you trust. Just because an email contains a name or logo you recognize doesn’t mean that it’s trustworthy. If an email misuses logos or names, or contains made-up names, something may be suspicious.

If you still aren’t sure, verify!

If you think a message could be legitimate, but you aren’t sure, try verifying it. Contact the alleged sender separately (e.g., by phone) to ask about the message. If you received an email instructing you to check your account settings or perform some similar action, go to your account page separately to check for notices or settings.

 

 

Using Get-SPWebTemplate to list available site templates in SharePoint 2013

In this tech-short we will go over a simple yet effective way to list out the available site templates in SharePoint 2013.

Using the New-SPSite PowerShell cmdlet allows you to specify the name of a template to use. In my case I was unaware of the name of available templates in my SharePoint installation.  Using the Get-SPWebTemplate command to produce a list for me.

Steps

  1. Open the SharePoint 2013 Management Shell
  2. The the following command: Get-SPWebTemplate | Sort-Object “Name”

The results are a list Templates which could be used in this environment.

 

If you wanted to do the same with PowerShell locally or remote the following steps can be taken.

Open PowerShell and issue the following commands:

  1. New-PSSession -ComputerName SharePoint
  2. Add-PSSnapin Microsoft.SharePoint.Powershell
  3. Get-SPWebTemplate | Sort-Object “Name”

SharePoint Server 2016 IT Preview

The SharePoint Server 2016 preview is now available to download from the Microsoft website:

http://www.microsoft.com/en-us/download/details.aspx?id=48712

Note: Windows Server 2012 R2 is required

Brief on Install Instructions

  1. Review SharePoint Server system requirements
  2. Download and install full-featured software for a 180-day trial
  3. When prompted, use the following product key: NQTMW-K63MQ-39G6H-B2CH9-FRDWJ

Unable to open Office Documents, SharePoint 2013 On-Prem

 

We have recently encountered a strange issue where users get stuck on the Word, Excel, Powerpoint splash logo where it says “Contacting the server for information.”  We have spent several days on this issue and it seems to have impacted a large user base.

I am working with the team here to find a resolution and as soon as I know of one I will share.

–update–

We have tested this in several test, demo SharePoint 2013 deployments and are facing the same issue.

Here is something new:  When tested with SharePoint Online the issue does not exist { scratching my head }

Joined in on a thread about this issue, where others are also facing the same incident
Link:  https://community.office365.com/en-us/f/154/p/412623/1024983#1024983

–update–

Steps taken: with no resolution

  • Attempt to open from SharePoint on another piece of hardware or virtual machine with the same exact versions of Office including updates – issue does not occur
  • Logging in with another use, even when creating a new profile on same affected OS / Hardware install the issue occurs
  • Attempts to remove windows updates, office updates do not resolve the issue
  • Repair or Uninstall followed by reinstall of Office 2013 doesn’t resolve the issue
  • Tested with a new SharePoint 2013, including a pre install contoso installations, the issue occurs

Environments:

We have workstations running Windows 8.1, Windows 10 all having these issues.

Note:

  1. this issue has not affected users who are using Office 2016
  2. this issue has not affected users who using SharePoint Online

No much more is known about this issues cause. The only solution which works at this time is to clean install or system restore to a point prior to this issues occurrence

There is a possibility that an antivirus may be causing this issue the future of the anti virus causing it is still unknown.

*UPDATE*

In my case this incident was directly related to ESET and its filtering of HTTP requests. Disabling this filtering resolved the issue.

I must note that disabling all security isn’t the best choice so here is some info from ESET to help you filter out and white list requests to avoid such an issue

http://support.eset.com/kb939/

 

Renaming SharePoint 2013 Server

I spent sometime today renaming SharePoint 2013 Servers for a project I was pulled in on. It involved using PowerShell cmdlets and other administrative tasks.

The project required me to “Clone” SharePoint farm servers to make template environments for demonstration and development task.

I originally followed steps provided here: Renaming SharePoint then later streamlined the process so its something I found useful. Here are my notes saved in PowerShell format so it could be run step by step using PowerShell ISE:

 

Best,

Jermal