Microsoft Outlook displays full contact details for spoofed senders
Cyber security research company Avanan has highlighted an omission in Outlook that it says renders the product vulnerable to phishing techniques.
In a blog post published today, the Check Point-owned company said that the Microsoft e-mail client would display extensive details about spoofed email senders without authenticating the e-mail first.
An attacker can send a spoofed e-mail to the target, pretending to be from someone in the organisation. The organisation’s Outlook client then looks up the spoofed sender’s details in the company’s Active Directory instance, filling in extra details for their identity.
Those details include photos, files shared between users, legitimate email addresses, and phone numbers. They can also see all of their previous communications with the spoofed colleague, creating a convincing listing in the victim’s Outlook client that gives the spoofed email greater credibility.
The attack can be used for typical phishing purposes including credential harvesting.
According to Avanan’s researchers, Outlook does not authenticate e-mails using technologies like the Sender Policy Framework (SPF) or DomainKeys Identifed Mail (DKIM). Instead, it leaves this to security tools that analyse e-mails before they reach a user’s inbox.
SPF is a record listing IP addresses that are authorized to send emails from a domain, while a DKIM check allows an email’s sender to sign it with a private key that the receiving software can then check.
To take advantage of this technique, the hacker must first successfully spoof the target organisation’s domain in a way that gets past anti-phishing scanners (assuming they have them).
“Spoofing is also made easier because Microsoft does not require verification before updating the user image on an e-mail,” Avanan’s researchers said. “It will display all contact data for a user, even if that user has an SPF fail.”
Microsoft users have asked about DKIM and SPF checks in Outlook on Microsoft’s technical forum for Outlook Desktop, but with little success.
To resolve these issues, Avanan recommends that organizations use layered security to analyse mails before the inbox, checking for malicious files and links. They should also check a domain’s reputation and run an SPF and DKIM check.
The Domain-based Message Authentication, Reporting & Conformance (DMARC) policy, built on SPF and DKIM, helps here. It links to the From: domain, and supports policies for recipient handling of authentication failures, along with reporting to senders. Avanan also recommends that admins protect any applications interacting with Active Directory.
In September, another researcher noted that Outlook would display a person’s real contact details even if a phishing e-mail used a homograph-based domain that looked similar to a legitimate one.
Ⓒ Future Publishing
Professional Development for IT professionals
The mission of the Irish Computer Society is to advance, promote and represent the interests of ICT professionals in Ireland. Membership of the ICS typically reduces courses by 20%. Find out more
Subscribers 0
Fans 0
Followers 0
Followers