New security warning for 400 million Outlook users as e-mail bug revealed

A security researcher has issued a warning to all 400 million users of 微软 Outlook after discovering an email bug that could allow anyone to impersonate official Microsoft accounts.

Vsevolod Kokorin, a security researcher at SolidLab, posted a message on X, formerly known as Twitter, expressing frustration with Microsoft after he had uncovered and responsibly disclosed a serious vulnerability impacting Outlook email, only to be told it couldn’t be reproduced.

The bug, which Kokorin rightly refuses to provide the technical details needed to exploit it at this time, enables anyone sending an email to another Outlook user to impersonate official Microsoft corporate accounts. As shown in the example posted to X, this means an email can appear to come from Microsoft’s security team, with all the implications for phishing, malware distribution and cybercrime that brings with it.

How To Mitigate The Risk Of New Outlook Spoofing Bug

While the vulnerability only appears to be exploitable when sending email from one Outlook user to another, given that there are around 400 million users it creates a huge threat surface.

Kokorin reached out to TechCrunch which has confirmed it received a spoofed email that did, indeed, appear to genuinely be from the Microsoft security team.

In an update to his original posting, Kokorin said of Microsoft that “at this point, they have acknowledged the issue,” which could mean a patch will be forthcoming if the vulnerability is found to be fixable. I sincerely hope it is, as Kokorin also said that the emails being spoofed passed the DMARC authentication tests that are meant to prevent just such a security threat.

Read the rest of the article here: https://easysam.co.uk/news/new-security-warning-for-400-million-outlook-users-as-e-mail-bug-revealed/