RE: Security Flaw with Digital signatures in Microsoft Outlook

From: Adrian Floarea (adrian.floarea_at_uti.ro)
Date: 03/25/05

  • Next message: Erwann ABALEA: "Re: [bugtraq] Security Flaw with Digital signatures in Microsoft Outlook" 
    To: <bugtraq@securityfocus.com>
Date: Fri, 25 Mar 2005 18:47:09 +0200

    As I see the problem, Outlook shows the name of the sender from the email
    instead the name from the signing certificate. And, by the way, Outlook is
    not a the best S/MIME client in this moment in time. I think is better, for
    the moment, to use other products in order to signing and encrypting emails.
    For example Netscape (which is free), or other commercial products which in
    conjunctions with Outlook offer a better security.

    Regards,

    Adrian Floarea
    Information Security Department
    IT&C Division, UTI Systems SA
    Bucharest, Romania
    Email: adrian.floarea@uti.ro

    -----Original Message-----
    From: Roberto Franceschetti [mailto:roberto@logsat.com]
    Sent: Friday, March 25, 2005 10:21 PM
    To: bugtraq@securityfocus.com
    Subject: Security Flaw with Digital signatures in Microsoft Outlook

    On 10/21/2004 the following vulnerability was reported to Microsoft:

    Security Flaw with Digital signatures in Microsoft Outlook - Emails in
    Microsoft Outlook digitally signed with S/MIME using either a commercial
    personal certificate like Verisign or using a certificate issued by MS
    Certificate Server can be altered. Outlook will not show any warnings about
    the email being changed, the digital signature will still be reported valid
    even though the message content has been modified and parties involved in
    the signatures changed. This is an extremely serious flaw as I can change
    any digitally signed emails I want without Outlook ever noticing. After
    several emails with Microsoft and CERT during the months that followed, no
    fixes have been issued to correct this security flaw. It is only now that I
    am making this information public after all my attempts to have Microsoft
    resolve the problem have failed.

    The following are 3 digitally signed messages. The 1st one is a valid,
    unmodified email from Roberto Franceschetti (roberto@logsat.com) to
    support@logsat.com: (follow the hyperlinks for the email's source and
    screenshots)

    Screenshot at http://www.logsat.com/Signatures/Valid.gif
    Email's source at http://www.logsat.com/Signatures/Valid.msg

    The following one has been "hacked" so that the sender now appears to be
    "Hackers Franceschetti" (hackers@logsat.com). Note that Outlook states that
    the email is absolutely valid, and that the certificate is Valid and
    Trusted. This is most definitely not the case, as I've altered the original
    message to make it appear as a different person actually sent it. Imagine
    the scenario where a digital signature is supposed to unequivocally identify
    a sender, but now this email that appears to be sent by "hackers" appears
    legitimate, and a poor victim will trust it and send the hacker any
    confidential information he is asked for... (follow the hyperlinks for the
    email's source):

    Screenshot at http://www.logsat.com/Signatures/Hacked1.gif
    Email's source at http://www.logsat.com/Signatures/Hacked1.msg

    This 3rd email is yet another variation showing how a digitally signed email
    can further be forget without Outlook ever raising warning flags (follow the
    hyperlinks for the email's source):

    Screenshot at http://www.logsat.com/Signatures/Hacked2.gif
    Email's source at http://www.logsat.com/Signatures/Hacked2.msg

    The full emails with the conversations between myself, Microsoft and CERT
    can be found here (http://www.logsat.com/Signatures/emails.asp). I hope that
    by making this information public all the users who rely on digital
    signatures will be aware of this severe security flaw in Microsoft Outlook,
    and will take other precautions to ensure the identity of users in digitally
    signed emails they receive.

    Roberto Franceschetti
    LogSat Software
    roberto@logsat.com

  • Next message: Erwann ABALEA: "Re: [bugtraq] Security Flaw with Digital signatures in Microsoft Outlook"

    Relevant Pages

    • Security Flaw in Microsoft Outlook and Digital Signatures
      ... Security Flaw with Digital signatures in Microsoft Outlook - ... no fixes have been issued to correct this security flaw. ...
      (comp.os.ms-windows.nt.admin.security)
    • Security Flaw in Microsoft Outlook and Digital Signatures
      ... Security Flaw with Digital signatures in Microsoft Outlook - ... no fixes have been issued to correct this security flaw. ...
      (microsoft.public.outlook.general)
    • Re: Outlook RPC over HTTp deosnt work
      ... Go to remote web workplace (or Outlook Web Access), accept the certificate prompt, 'view', and 'install' the certificate - accepting all the defaults. ... > when you try to use RPC over HTTP to connect the Exchange Server. ...
      (microsoft.public.windows.server.sbs)
    • Re: RPC over HTTP
      ... We have already set up Outlook Web Access and purchase a SSL Certificate ... I have used the "outlook.exe /rpcdiag" to see if it uses the HTTP ... firewall through to the exchange server. ...
      (microsoft.public.windows.server.sbs)
    • Re: Infinite series of login prompts for Outlook Anywhere
      ... I went to GoDaddy and bought a single-domain certificate on which ... my SBS server is the only name. ... And now Outlook Anywhere works from ... SBS 2008 Standard, ...
      (microsoft.public.windows.server.sbs)