Americas

  • United States

Asia

sbradley
Contributing Writer

Email woes gotcha worried? How to fix problems and fend off attacks

opinion
Sep 12, 20224 mins
Email ClientsMicrosoftMicrosoft Outlook

Email has become a major vector for attackers, prompting ISPs to tighten up their defenses. That, in turn, may be causing some issues for behind-the-times email users. Here's how to sort things out.

Email encryption  >  An encrypted binary 'at' symbol with a keyhole.

Email is one of those tools people keep saying will one day die and be replaced with a better communication platform. And yet, because it is nearly universal and works across platforms so well, it’s still here.

But working across platforms is not the same as working well for everyone all the time. I’ve seen a lot of concern about the rising number of email-based attacks and a lot of complaints from people having email trouble in general — with many blaming Outlook or some other client for recent problems.

In fact, the underlying cause might be more straightforward: ISPs have been moving to more modern authentication processes (to fend off attacks) and some email clients can’t handle the changes. Case in point: Microsoft, which is slowly but surely disabling basic authentication and moving to better levels of protection. (If your mail platform still uses basic authentication, attackers are almost certainly trying to crack your passwords with password spraying and harvested credentials.)

Here’s what to do to resolve basic email issues and still insure you’re protected from attackers.

Email problem-solving 101

Generally speaking, if you’re having issues accessing email using the same app you’ve always (and the same password), the first thing to do is double-check your password. A simple way to do this is log into the web version of your email platform. If you can get in, you have the right credentials. I’ve seen instances where an ISP has changed their requirements for password complexity and it’s only by  logging in online that I find out about this fact. (This would also be a good time to consider adding two-factor authentication to your personal email account, especially those used to authenticate financial institutions.)

You might also find that you’re actually using older versions of Outlook that don’t support modern authentication. While Microsoft 365 may have dropped support for versions prior to 2013’s Service Pack 1, other mail servers might have continued to support these older platforms. Your ISP may have changed email requirements — and you missed the memo.

If you’re still using Outlook, always check whether removing your email account and setting it up again fresh is enough to get your client to kick off stronger authentication processes. If your account is already in iMAP format, you won’t lose any email. If that doesn’t work, consider upgrading to either a newer version of Outlook, a different email client all together, or to a different Office platform entirely. 

If you do the latter, beware cheap versions of Office that aren’t in line with what you see on the Microsoft website; chances are it’s a scam. Even on reputable sites, I’ve seen Office offered for as low at $39.99. The buyer ends up with a product key that doesn’t work and an offer to buy Microsoft 365. And you might not need the Office suite at all. Unless you’re deeply entrenched in Word and Excel documents with Macros, alternative suites should work fine. Libre Office might solve your document and spreadsheet needs, and there are numerous third-party options for email. (While Outlook remains a key player in the business world, it’s losing its hold on the consumer space.

Beyond Outlook, you have options

If you like Firefox, you might try Thunderbird. It, too, has a mail setup wizard that allows you to easily create your email account. Another option is EM, which is similar to Outlook. Both run in Windows and on Macs, so if you’re moving between either one, any mail migration should be fairly simple. Best of all, you can usually test these kinds of alternative platforms for free before buying. 

If your email is still located in a downloaded pst file, you can typically find tools to migrate from one platform to another. I’ve used Systools to migrate easily from Zoho to Microsoft 365 and Recoverytools to export an Outlook pst file into a Thunderbird format  I recommend looking for a paid tool to ensure you can get support for any issues you have.

The bottom line here is that when it comes to email, don’t get tied down using an out-of-date version of Outlook. If you haven’t received updates in years, you’re placing yourself at risk for attacks and threats. Especially for small businesses, business email compromise is a major risk exacerbated by older platforms.

If you find yourself having email problems, make sure your credentials are up to date, check for any ISP changes, and make sure Outlook (if that’s your preferred client) has been updated. And if you don’t like Outlook, move to an alternative that works for you.

That’s the best way to make it hard for the bad guys to get into your systems.

sbradley
Contributing Writer

Susan Bradley has been patching since before the Code Red/Nimda days and remembers exactly where she was when SQL slammer hit (trying to buy something on eBay and wondering why the Internet was so slow). She writes the Patch Watch column for Askwoody.com, is a moderator on the PatchManagement.org listserve, and writes a column of Windows security tips for CSOonline.com. In real life, she’s the IT wrangler at her firm, Tamiyasu, Smith, Horn and Braun, where she manages a fleet of Windows servers, Microsoft 365 deployments, Azure instances, desktops, a few Macs, several iPads, a few Surface devices, several iPhones and tries to keep patches up to date on all of them. In addition, she provides forensic computer investigations for the litigation consulting arm of the firm. She blogs at https://www.askwoody.com/tag/patch-lady-posts/ and is on twitter at @sbsdiva. She lurks on Twitter and Facebook, so if you are on Facebook with her, she really did read what you posted. She has a SANS/GSEC certification in security and prefers Heavy Duty Reynolds wrap for her tinfoil hat.