Exchange email keeps asking for password

Exchange email keeps asking for password software#

In four months, Guardicore says it identified 340,000 exposed Exchange mailbox credentials hitting those domains. In April, Guardicore Labs acquired the autodiscover domains for some of the most common top-level domains - autodiscover.uk,, and so on - and set them to вЂњlistenвЂќ to leaky requests as they arrive. Several apps were fixed at the time, but itвЂ™s clearly a problem that hasnвЂ™t gone away. Researchers have for years warned that email apps are vulnerable to this kind of data leakage and can put a companyвЂ™s credentials at risk. Anyone who owns that domain name could вЂњlistenвЂќ to the email addresses and passwords as they are sent across the internet. ThatвЂ™s a problem, because behind the scenes the app is trying to communicate with a domain name thatвЂ™s outside of the companyвЂ™s control but within the same top-level domain - so, for example, would end up looking for the configuration file on. And if it canвЂ™t find the file, then users are left with the inconvenience.Д«ut some apps will inadvertently fail up one step further before hitting a wall.

Each time it looks somewhere and canвЂ™t find it, the app will вЂњfail upвЂќ and look somewhere else on the same domain. Most apps will look for the configuration file in places on the companyвЂ™s domain where it knows to look. ItвЂ™s meant to make it easier to set up an email or calendar app, for example, by offloading the hard work to the server rather than configuring the app by hand.

Exchange email keeps asking for password software#

Shipping companies, power plants and investment banks donвЂ™t often share much in common, but new research shows they are all inadvertently leaking thousands of email passwords of their own employees, thanks in part to a design flaw in a widely used email protocol.ДЄutodiscover is a feature in Microsoft Exchange, a popular email software for companies to host their own email servers, to set up apps on a phone or a computer using just an employeeвЂ™s email address and password.