Flaw in Microsoft Office 365 Message Encryption could expose email contents to attackers

Adversaries can exploit the flaw, for which there is no patch available, to obtain information that could lead to a full or partial information disclosure.

Helsinki, Finland – October 14, 2022: Today, WithSecure™ (formerly known as F-Secure Business) published a security advisory warning organizations of a security flaw in Microsoft Office 365 Message Encryption (OME).

OME, which is used by organizations to send encrypted emails internally and externally, utilizes the Electronic Codebook (ECB) implementation – a mode of operation known to leak certain structural information about messages.

Attackers able to obtain enough OME emails could use the leaked information to partially or fully infer the contents of the messages by analyzing the location and frequency of repeated patterns in individual messages, and then matching these patterns to ones found in other OME emails and files.

“Attackers who are able to get their hands on multiple messages can use the leaked ECB info to figure out the encrypted contents. More emails make this process easier and more accurate, so it’s something attackers can perform after getting their hands on e-mail archives stolen during a data breach, or by breaking into someone’s email account, e-mail server or gaining access to backups,” explained WithSecure™ consultant and security researcher Harry Sintonen, who discovered the issue.

According to the advisory, the analysis can be done offline, meaning an attacker could compromise backlogs or archives of previous messages. Unfortunately, organizations have no way to prevent an attacker that comes into possession of affected emails from compromising its contents using the method outlined in Sintonen’s advisory.

The advisory also highlights that no knowledge of the encryption keys is needed to conduct the analysis, and that use of a Bring Your Own Key (BYOK) scheme does not remedy the problem.

Sintonen shared his research with Microsoft in January 2022. While Microsoft acknowledged the problem and paid Sintonen via their vulnerability reward program, they opted not to issue a fix. While organizations can mitigate the problem simply by not using the feature, it does not address the risks of adversaries gaining access to existing emails encrypted with OME.

“Any organization with personnel that used OME to encrypt emails are basically stuck with this problem. For some, such as those that have confidentiality requirements put into contracts or local regulations, this could create some issues. And then of course, there’s questions about the impact this data could have in the event it’s actually stolen, which makes it a significant concern for organizations,” said Sintonen.   

Because there is no fix from Microsoft or a more secure mode of operation available to email admins or users, WithSecure™ recommends avoiding the use of OME as a means of ensuring the confidentiality of emails.

The full advisory is available on WithSecure Labs: https://labs.withsecure.com/advisories/microsoft-office-365-message-encryption-insecure-mode-of-operation.html.

WithSecure™ media relations
Adam Pilkey
+358406378859