- WithSecure warns organizations of a security flaw in Microsoft Office 365 Message Encryption.
- Attackers able to obtain enough OME emails could use the leaked information to infer the contents of the messages.
- Microsoft acknowledged the problem and paid Sintonen via their vulnerability reward program, but they opted not to issue a fix.
WithSecure, formerly known as F-Secure Business, pinpoints a flaw in Microsoft Office 365 Message Encryption (OME) that could expose email contents to unauthorized third parties. Organizations are using OME to send encrypted emails, both internally and externally. It uses the Electronic Codebook (ECB) implementation, which is a mode of operation that leaks certain structural information about messages.
Matching patterns
The flaw, discovered by Harry Sintonen, allows attackers who obtain enough OME emails to use the leaked information to infer the contents of the message, partially or fully, by analyzing the location and frequency of repeated patterns in individual messages, and then matching these patterns to ones found in other OME emails and files.
Attackers can complete the analysis offline, which allows them to compromise backlogs or archives of previous messages. Currently, there is no known method to prevent an attacker if the attacker could obtain affected emails from compromising email contents.
The researcher who discovered the vulnerability, Harry Sintonen, shared the information with Microsoft in January 2022. The tech giant has acknowledged the problem and paid Sintonen via its vulnerability reward program, however, decided not to fix the issue. Harry Sintonen, consultant and security researcher at WithSecure said,
« Attackers who are able to get their hands on multiple messages can use the leaked ECB info to figure out the encrypted contents. More emails make this process easier and more accurate, so it’s something attackers can perform after getting their hands on e-mail archives stolen during a data breach, or by breaking into someone’s email account, e-mail server or gaining access to backup.
Any organization with personnel that used OME to encrypt emails are basically stuck with this problem. For some, such as those that have confidentiality requirements put into contracts or local regulations, this could create some issues. And then of course, there’s questions about the impact this data could have in the event it’s actually stolen, which makes it a significant concern for organizations. »