A free security audit · Rappahannock County
Two offices in this county were broken into recently. Through their email.
On September 15 the county zoning office’s account sent a fake “shared document” to the people it deals with. On September 23 a local nonprofit’s staff account did the same to its whole contact list. Neither was a look-alike address. Both were the real account, with a stolen password.
I’d like to check yours before it’s your turn. It’s free, it takes about an hour of your time, and you keep the report.
ALREADY BEEN HIT?
If an account is sending mail you didn’t write, don’t wait for the form. Change that password, sign the account out of every session from your admin console, turn on 2-step verification, then call me. The rest can wait an hour. That can’t.
What happened here
The same trick, twice in eight days.
September 15. The county zoning office. An email went out from the zoning office’s real account with a link to an “estimate” for a building project. The link opened a fake Dropbox page on an anonymous cloud storage account. Its web address had been built from the office’s own county username so it would read as county business. It asked for an email address, then a password. There was no document. I traced it, reported it to Amazon, to Dropbox, and to the Anti-Phishing Working Group that morning, and told the county. The County Administrator confirmed staff had been warned and matching mail quarantined.
September 23. A nonprofit that serves families here. At 10:38 that morning an “ACTION REQUIRED” email went to everyone in a staff member’s address book, blind-copied, signed with a name that didn’t match the sender’s. The link bounced through a German university’s login server so it would look trustworthy, then landed on a fake document screen built to collect passwords. The domain behind it was six weeks old. I traced it without opening it, reported it to the host, the working group, and the university, and sent the organization a fix list. They had it in hand within the hour.
Neither email was faked. Each came from the real account, with the real password, and went to the real contact list. That is what a stolen password looks like from the outside.
Nearly all of this starts the same way. Someone on staff gets a convincing email, types their password into a page that isn’t what it claims to be, and from then on the attacker sends as them, reads as them, and quietly sets up rules so the replies saying “you’ve been hacked” never reach the inbox. The office usually finds out when a customer calls.
What I’ll check
An hour with whoever runs your email.
Nothing gets installed and nothing gets changed without you. We go through the admin side of your email together, on a call or at your desk, and I look for the things attackers rely on:
- 1
Whether every account has 2-step verification on, and which ones don’t.
A stolen password on its own should not be enough to get in. This one setting would have stopped both of these recent break-ins.
- 2
Forwarding rules, filters, delegates, and connected apps nobody remembers adding.
This is how an attacker keeps reading your mail after the password is changed.
- 3
Whether your domain is set up so strangers can’t send mail as you.
Three settings on your domain, called SPF, DKIM, and DMARC, tell the world’s mail servers which senders are really you. Most small offices have none of them.
- 4
Shared passwords, old staff accounts, and generic logins that still work.
The info@ mailbox, the volunteer who left in 2023, the password on a sticky note. Who holds them, and whether they should.
- 5
What your staff would see if one of these emails landed in their inbox.
Whether your filters would catch it, and what the tells are when they don’t.
- 6
Anything else that worries you.
The computer the books live on, the backups nobody has tested, the website login. Bring it.
What you get
One page, in plain English.
A short written report: what I found, what to fix first, and how, in language your board or your bookkeeper can read. Most of the fixes take an afternoon and cost nothing. They are settings, not purchases. The report is yours whether or not you ever speak to me again.
- Cost
- Free. No invoice, no card, no catch.
- Your time
- About an hour, on a call or at your desk.
- Who’s there
- You, and whoever manages your email.
- Afterward
- A one-page report. No obligation.
Why free
Because I live here.
I’m Justin Lock. I live in Rappahannock County, and I build and run software for the small businesses here through Holler. When the zoning office’s email went out, I traced it, reported it, and told the county the same morning. Same with the second one. I would rather do that work before the fact than after.
The audit is free with no strings. If the report says something needs real work and you would like me to do it, that is an ordinary paid job you can say yes or no to. Most offices won’t need it. Holler is a new company, and this is how I’d like to meet the people who run this county.
If it’s easier to just talk, call me at 540.308.1232, or write to hello@holler.software.