Security News > 2022 > October > Microsoft Office 365 email encryption could expose message content
Security researchers at WithSecure, previously F-Secure Business, found that it is possible to partially or fully infer the contents of encrypted messages sent through Microsoft Office 365 due to the use of a weak block cipher mode of operation.
Organizations use Office 365 Message Encryption to send or receive emails, both external and internal, to ensure confidentiality of the content from destination to source.
Harry Sintonen of WithSecure underlines that with Office 365 Message Encryption the content of the encrypted messages isn't directly decipherable, but structural information about those messages can be captured.
An attacker able to collect multiple encrypted messages can look for patterns that could lead to parts of the message to become gradually readable without the need of an encryption key.
To demonstrate that this can be achieved, Sintonen revealed the content of an image protected by Office 365 Message Encryption.
WithSecure recommends that until a more secure mode of operation becomes available, users and admins should stop using or trusting the Office 365 Message Encryption feature.
News URL
Related news
- Fake Microsoft Office add-in tools push malware via SourceForge (source)
- Microsoft blocks ActiveX by default in Microsoft 365, Office 2024 (source)
- Hidden Threats: How Microsoft 365 Backups Store Risks for Future Attacks (source)
- Microsoft: New Windows scheduled task will launch Office apps faster (source)
- Microsoft Warns of Tax-Themed Email Attacks Using PDFs and QR Codes to Deliver Malware (source)
- Microsoft: Licensing issue blocks Microsoft 365 Family for some users (source)
- Microsoft releases emergency update to fix Office 2016 crashes (source)
- Tycoon2FA phishing kit targets Microsoft 365 with new tricks (source)
- ActiveX blocked by default in Microsoft 365 because remote code execution is bad, OK? (source)
- Microsoft: Office 2016 and Office 2019 reach end of support in October (source)