1

Ok, so this one is a doozy. I've been working on this for literally months so I honestly hope it's not a simple check box issue.

We use Wombat Security for phishing campaigns and they provide us with an Outlook plugin button for end-users to report potential phish emails to the security team (me). We configured that button to send directly to our cloud ticketing system, which automatically opens a ticket. So the end-user selects a suspect message, clicks the "Report Phish" button in Outlook, the button takes the suspect message and forwards it as an attachment to our cloud ticketing system and also attaches a text file with the header information of the suspect email. Easy peazy.

This worked flawlessly for over a year.

About two and half months ago the tickets we get from the Outlook button stopped including attachments. The email still goes through and opens a ticket but there is no header or forwarded email attachments.

Fast forward to today and here's what I've done and what I know.

I setup a transport rule in Exchange so any emails sent to the cloud ticketing email address get BCC to my work email and my gmail account. This way I can see what's actually being sent.

When I use the button to report a phish, it shows up in the sent items with both attachments.

The email I get at my work email via the transport rule has both attachments. The email I get at my gmail only contains the text file, no email attachment.

So my attachments, when sending emails via the Outlook plugin, are somehow getting dropped somewhere in transit. But I have no idea how or why or how to find out more.

So, that's my question. Where in Exchange 2010 logs (or Outlook 2016) could I find out what's happening to my attachments?

Fun little tidbit related to the issue above, when I go into my sent items, open the message sent from the Outlook plugin and just hit resend - it sends the email with attachments. Everything works as it should. Which points to the Outlook plugin being the issue EXCEPT that this happened for all my users at the same time regardless of the version of Outlook plugin they are using. We didn't upgrade Outlook version, Exchange, or the Outlook plugin. Which then points back to Exchange. Hence why I've been working on this for over 2 months.

1

Exchange doesn't drop attachments. Exchange 2010 is now in extended support, so nothing will be changing with that product - and hasn't done so for some time.

The fact that you getting a copy of the email correctly on a transport rule means the email is passing through Exchange correctly - I think you are too quick to blame Exchange because nothing you have written tells me it is Exchange. Everything goes through Exchange transport - if the problem was with Exchange then the attachment wouldn't reach your mailbox. The attachment is being dropped after it has left Exchange.

I would be looking at the path. AV software installed somewhere, firewall scanning SMTP traffic. As you don't receive the attachment in a Gmail account suggests the problem is between Exchange and the internet. Looking at the headers as received by GMAIL may also give a clue. I have seen attachments get malformed in the past and have ended up in the headers. A firewall scanning SMTP traffic for example could damage the attachment meaning it isn't rendered correctly. Looking at the size of the mail can be clue here - if the size is the same or close to that received by Exchange then that points to the attachment being there but not seen by the client.

  • I like your pro exchange philosophy but what I'm looking for is evidence to backup your claims. I'm not saying you're wrong, I'm asking if there is evidence that proves it. It would help me tremendously with the support ticket I have open with Wombat. When the button sends an email it's not getting to gmail correctly. But if I open that same email and resend it it does. Is there any place from Exchange backwards that might show what's happening so I can figure out why one works and the other doesn't? – LDJS Jan 8 '18 at 15:51
  • There is nothing to prove otherwise. Nothing you have posted points the finger at Exchange - the fact that you receive the email in another mailbox proves it isn't Exchange because the architecture of Exchange means all email whether internal or external goes through transport and that is the only place the attachment could be dropped. – Sembee Jan 10 '18 at 20:24
  • You sound financially and emotionally invested in Exchange. Sorry I insulted you. I'm not trying to pick on Exchange here, I'm just trying to get to the bottom of this issue. The email sent by the Outlook plugin doesn't work but if I send literally the exact same message it does. It's not our AV software or firewall or it would consistently block both attachments. Again, I'm not saying it's Exchange, I'm asking where I can look for logs that might show why the attachment goes out on one message but not on another. – LDJS Jan 11 '18 at 22:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.