New security warning for 400 million Outlook users as e-mail bug revealed
New security warning for 400 million Outlook users as e-mail bug revealed
A security researcher has discovered it's possible to impersonate Microsoft corporate accounts when sending e-mails to other Outlook users.
Published on 24th June 2024
A security researcher has issued a warning to all 400 million users of Microsoft Outlook after discovering an email bug that could allow anyone to impersonate official Microsoft accounts.
Vsevolod Kokorin, a security researcher at SolidLab, posted a message on X, formerly known as Twitter, expressing frustration with Microsoft after he had uncovered and responsibly disclosed a serious vulnerability impacting Outlook email, only to be told it couldn’t be reproduced.
The bug, which Kokorin rightly refuses to provide the technical details needed to exploit it at this time, enables anyone sending an email to another Outlook user to impersonate official Microsoft corporate accounts. As shown in the example posted to X, this means an email can appear to come from Microsoft’s security team, with all the implications for phishing, malware distribution and cybercrime that brings with it.
How To Mitigate The Risk Of New Outlook Spoofing Bug
While the vulnerability only appears to be exploitable when sending email from one Outlook user to another, given that there are around 400 million users it creates a huge threat surface.
Kokorin reached out to TechCrunch which has confirmed it received a spoofed email that did, indeed, appear to genuinely be from the Microsoft security team.
In an update to his original posting, Kokorin said of Microsoft that “at this point, they have acknowledged the issue,” which could mean a patch will be forthcoming if the vulnerability is found to be fixable. I sincerely hope it is, as Kokorin also said that the emails being spoofed passed the DMARC authentication tests that are meant to prevent just such a security threat.
The Security Expert View
Max Gannon, the cyber intelligence team manager at Condense, warned that, if confirmed, “this bug could allow the targeting of even the most suspicious and well-trained individuals.”
Gannon said that the reported vulnerability shows how reliant we are on companies like Microsoft to prevent such bugs. “It also highlights how important it is for major companies to take security researchers seriously and apply more than a token effort to verify bugs that have the potential to cause significant harm,” Gannon concluded.
