Researchers Claim Microsoft Office 365 Employs Flawed Email Encryption for Message Security

A recent investigation has uncovered a significant security vulnerability within Microsoft 365. This flaw may allow malicious actors to deduce the contents of encrypted messages, stemming from the implementation of a compromised cryptographic algorithm.

According to a report from Finnish cybersecurity firm WithSecure, the encryption mechanism of Office 365 Message Encryption (OME) employs an insecure mode of operation, specifically Electronic Codebook (ECB) mode. This mode, which encrypts each message block independently, is inherently flawed as it transforms identical plaintext blocks into identical ciphertext blocks, compromising confidentiality. The report highlights how this vulnerability could expose sensitive information to unauthorized third parties.

OME is intended to securely transmit encrypted emails between users both within and outside an organization, concealing the nature of the communications. However, the newly identified vulnerability raises alarms about the potential for third-party attackers to access encrypted emails and decipher their contents.

The risks associated with ECB mode are well documented. The U.S. National Institute of Standards and Technology (NIST) has previously noted that ECB encrypts plaintext blocks without randomization, allowing attackers to analyze ciphertext blocks to determine if corresponding plaintext blocks are identical. The challenge highlighted by WithSecure is not merely about decrypting a single message but rather involves analyzing a larger collection of encrypted emails to exploit identifiable patterns.

WithSecure indicates that an adversary armed with a substantial dataset of intercepted messages could infer partial or full contents by scrutinizing the arrangement of recurring sections. This points to a worrisome trend in cybersecurity, characterized by the threat of “hack now, decrypt later,” which raises concerns about the possibility of data being decrypted and exploited in future attacks.

As for the implications of this vulnerability, Microsoft has classified OME as a legacy system. The company urges users to transition to a more secure data governance solution called Microsoft Purview for email and document encryption, emphasizing that while both versions of OME can run concurrently, they strongly recommend updating to Purview Message Encryption.

Currently, there are no plans for Microsoft to address this vulnerability within OME, leading experts to caution against its continued use. The situation highlights the critical necessity for organizations to revisit and enhance their encryption strategies, particularly as they relate to safeguarding sensitive communications against evolving threats.