Re: [bugtraq] Security Flaw with Digital signatures in Microsoft Outlook

From: Erwann ABALEA (erwann.abalea_at_certplus.com)
Date: 03/25/05

  • Next message: Marc Deslauriers: "[FLSA-2005:2155] Updated sharutils package fixes security issues" 
    Date: Fri, 25 Mar 2005 17:50:05 +0100
To: Roberto Franceschetti <roberto@logsat.com>

    Bonjour,

    Hodie VIII Kal. Apr. MMV est, Roberto Franceschetti scripsit:
    > The following one has been "hacked" so that the sender now appears to be "Hackers Franceschetti" (hackers@logsat.com). Note that Outlook states that the email is absolutely valid, and that the certificate is Valid and Trusted. This is most definitely not the case, as I've altered the original message to make it appear as a different person actually sent it. Imagine the scenario where a digital signature is supposed to unequivocally identify a sender, but now this email that appears to be sent by "hackers" appears legitimate, and a poor victim will trust it and send the hacker any confidential information he is asked for... (follow the hyperlinks for the email's source):

    It is clearly indicated "Signed by: roberto@logsat.com", what's the
    problem? (see below)

    > Screenshot at http://www.logsat.com/Signatures/Hacked1.gif
    > Email's source at http://www.logsat.com/Signatures/Hacked1.msg

    It's not an email, it's a binary message that can be opened only by
    Microsoft Outlook. Could you please provide pure text messages? Same
    request for your conversation between MS, CERT, and you.

    > This 3rd email is yet another variation showing how a digitally signed email can further be forget without Outlook ever raising warning flags (follow the hyperlinks for the email's source):

    In your 2 examples, you aparently fail to notice that the envelope of
    the message is not signed *at all*. What you're modifying in precisely
    this envelope. What is really signed is the *body* of the message,
    that's all. If you change the "From" address, or the subject, or the
    sending date, that won't invalidate the signature.

    I don't like to say this, but here, Microsoft did something useful for
    the end user, by clearly displaying the identity of the signer, along
    with the declared identity of the sender. If you want them to do more,
    that's something else. But cryptographically speaking, the signatures
    haven't been invalidated by your manipulations.

    > The full emails with the conversations between myself, Microsoft and CERT can be found here (http://www.logsat.com/Signatures/emails.asp). I hope that by making this information public all the users who rely on digital signatures will be aware of this severe security flaw in Microsoft Outlook, and will take other precautions to ensure the identity of users in digitally signed emails they receive.

    Could you reformat your web page? It's difficult to read, and .msg
    files don't fit my Linux machine. 

    -- 
Erwann ABALEA <erwann.abalea@keynectis.com>
  • Next message: Marc Deslauriers: "[FLSA-2005:2155] Updated sharutils package fixes security issues"

    Relevant Pages

    • Re: Outlook 2003 -Forms -Preview Pane...
      ... Author of Configuring Microsoft Outlook 2003 ... signature to say "Please double click the message to view this form" BEFORE ... Now whenever that form is sent/received the reading pane will say my ... What I can't figure out is how to have the form display ...
      (microsoft.public.outlook.program_forms)
    • how to make email signature compatible with Microsoft Outlook
      ... I composed HTML email signature for a friend who uses Thunderbird, ... The signature /views/ fine in all email clients, including Microsoft Outlook ... Notes, seeing the problem in Lotus Notes, people blame Lotus Notes; ...
      (comp.infosystems.www.authoring.html)
    • Re: Outlook form with vbscript
      ... Author of Configuring Microsoft Outlook 2003 ... the receiving end is getting an error stating "form cannot be opened". ... However, If I insert my signature into the form, or the signature is ... a way to paste it at the beginning of the message area? ...
      (microsoft.public.outlook.program_forms)
    • Re: PRF file creates backup of profile
      ... Yes, I finally got around to trying it, but it never creates a backup profile. ... Author of Configuring Microsoft Outlook 2003 ... I suspect, though, that changing server may be treated by Outlook as a new account and thus would have no signature associated with it. ... run the prf file, it creates a backup of the old profile. ...
      (microsoft.public.outlook.installation)
    • Error with signature
      ... they get an error message stating that: ... "Saving a copy of this document will invalidate all of the signatures in the ... include a signature and ensure that the signature does ...
      (microsoft.public.word.docmanagement)