Security Flaw with Digital signatures in Microsoft Outlook

Security Flaw with Digital signatures in Microsoft Outlook
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Security Flaw with Digital signatures in Microsoft Outlook jeff.ggl007 08-01-2006
Posted by on August 1, 2006, 9:41 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Does anyone know if this problem with Outlook Digital Signatures has
been resolved by Microsoft?

======================================================
http://archive.cert.uni-stuttgart.de/archive/bugtraq/2005/03/msg00438.html

http://www.logsat.com/Signatures/emails.asp
======================================================

Sounds like a serious problem to me.

I have recently started using digital certificates in OE and MS Outlook
2002/2003. It is a great way to send encrypted messages between
recipients who have certificates. As well, it is a great way to ensure
who messages are from for identity purposes.

However, I have encountered some problems with some recipients not
being able to open MS Outlook messages that have been signed (but not
encrypted). While trying to research the cause of this problem, I came
across the noted web sites above where the author was trying trying to
resolve a problem of spoofed "signed" messages that Outlook Express did
not catch. According to the authors documented correspondence with
Microsoft, they were not acknowledging the problem.

Anyone know if there is other verification of this problem?
And, has Microsoft fixed this?
If true, this is a very serious flaw.


Posted by S. Pidgorny on August 2, 2006, 5:29 am
If you were  Registered and logged in, you could reply and use other advanced thread options
The problem is that Outlook is displaying the sender from SMTP headers that
can be different from one who actually signs the e-mail. The reason for that
is because the message content is signed before SMTP headers are added -
which makes total sense and won't change.

Is that the right recap of the issue?
Also - do you see diferent behaviour in another mail clients?

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

> Does anyone know if this problem with Outlook Digital Signatures has
> been resolved by Microsoft?
>
> ======================================================
> http://archive.cert.uni-stuttgart.de/archive/bugtraq/2005/03/msg00438.html
>
> http://www.logsat.com/Signatures/emails.asp
> ======================================================
>
> Sounds like a serious problem to me.
>
> I have recently started using digital certificates in OE and MS Outlook
> 2002/2003. It is a great way to send encrypted messages between
> recipients who have certificates. As well, it is a great way to ensure
> who messages are from for identity purposes.
>
> However, I have encountered some problems with some recipients not
> being able to open MS Outlook messages that have been signed (but not
> encrypted). While trying to research the cause of this problem, I came
> across the noted web sites above where the author was trying trying to
> resolve a problem of spoofed "signed" messages that Outlook Express did
> not catch. According to the authors documented correspondence with
> Microsoft, they were not acknowledging the problem.
>
> Anyone know if there is other verification of this problem?
> And, has Microsoft fixed this?
> If true, this is a very serious flaw.
>



Posted by Karl Levinson on August 2, 2006, 7:45 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Note that, from the screen shots, Outlook is displaying both the From: field
AND the field of who signed the email.

If the recipient overlooks that, I believe they'd probably also overlook a
lot of other warnings as well.

> The problem is that Outlook is displaying the sender from SMTP headers
> that can be different from one who actually signs the e-mail. The reason
> for that is because the message content is signed before SMTP headers are
> added - which makes total sense and won't change.
>
> Is that the right recap of the issue?
> Also - do you see diferent behaviour in another mail clients?



Posted by on August 2, 2006, 10:17 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Both your comments are true and valid - no argument.

It is clear from the example:
http://www.logsat.com/Signatures/default.asp
that if a recipient takes the time to note from the mail header that
the "From" field does not match the "signed by" field. For users who
are willing to always read headers and related details, then it would
be obvious that there is a problem with the received signed message.

But, from the point of software user-friendlyness, and even more so
from the point of security, good software should "flag" the recipient
that there is a "descrepancy" between the "From" field and the
"signed-by" fields. This would seeminly be an easy enough task for the
Microsoft developers of Outlook.

Spammers, virus authors, and other malicious mailers know they can
count on social engineering and user laziness to take advantage of
security holes or softspots to penetrate the unsuspecting. Not all
mail users are "technically inclined" to check all the details of a
mail message to determine it's validity. And, well designed software
should not require such user intervention. This is why we have virus
scanning software and malware/adware scanners - to save us the trouble
of having to technically scrutenize every singe message or software
residing on our PC's. For those of us who are technically inclined or
talented we take it upon ourselves to do much of that work. But, I
know from personal experience that the majority of PC users (especially
home users who are not technically inclined) do not understand all this
stuff - they just want to rely on the software to take care of the
security issues for them. The purpose of digital certificates is to
provide users with a sense of "knowing without having to double-check"
that the signed message is in-fact from the person the signed message
says it is from.

In my opinion, Microsoft needs to fix this issue by flagging recipients
that the signed message (certificate) does not match the sender "From"
field. I believe digital certificates are a good solution to digital
identification over the net. But, I would like to feel confident that
when I receive a signed message, it is truely from the person I belive
it is from without having to do a bunch of double checking first.

Regards, Jeff



Karl Levinson wrote:
> Note that, from the screen shots, Outlook is displaying both the From: field
> AND the field of who signed the email.
>
> If the recipient overlooks that, I believe they'd probably also overlook a
> lot of other warnings as well.
>
> > The problem is that Outlook is displaying the sender from SMTP headers
> > that can be different from one who actually signs the e-mail. The reason
> > for that is because the message content is signed before SMTP headers are
> > added - which makes total sense and won't change.
> >
> > Is that the right recap of the issue?
> > Also - do you see diferent behaviour in another mail clients?


Posted by Karl Levinson on August 2, 2006, 7:42 am
If you were  Registered and logged in, you could reply and use other advanced thread options

> Does anyone know if this problem with Outlook Digital Signatures has
> been resolved by Microsoft?
>
> ======================================================
> http://archive.cert.uni-stuttgart.de/archive/bugtraq/2005/03/msg00438.html
>
> http://www.logsat.com/Signatures/emails.asp
> ======================================================
>
> Sounds like a serious problem to me.

I don't believe this is really a vuln with Outlook exactly but with the
S/MIME protocol and RFC. I don't believe Outlook is the only email client
affected by this.

The reality is that email certificate security relies on the recipient to
look and check that the certificate is signing what you think it is signing.
There are a number of ways that a recipient could overlook a problem with a
signed email, whether using Outlook, PGP, etc.

If you look at the screen shots below, Outlook clearly shows in ALL cases
that the forged emails were NOT signed by the White House. Outlook
accurately shows, right in the initial email, who truly signed the email.

http://www.logsat.com/Signatures/default.asp

Email encryption programs generally don't beat the user over the head with
warnings, and this is sometimes a concern. Making them beat the user over
the head with warnings is a good idea, but in this case it can sometimes
possibly result in false alarms, as Microsoft asserted in their email chain.
So once again, despite the warnings, the recipient is responsible for
manually viewing and determining whether they trust the email, the sender
and the signature.

IMHO this is a bit of a grey area where both sides in the argument have some
merit. It is not as black and white as the reporter very impatiently and
angrily claims.





Similar ThreadsPosted
Yet another new outlook and IE security flaw discovered... September 9, 2005, 12:46 am
[?] Certificates + Digital Signatures June 23, 2005, 6:18 pm
Printing Digital Signatures December 28, 2006, 6:44 pm
Digital certificate in outlook April 24, 2007, 9:36 am
Digital certificate in outlook April 24, 2007, 9:37 am
How to get Digital Certificate for Outlook 2007? January 24, 2008, 4:56 pm
Digital Certificate for Outlook 2007 Email encryption and signing October 9, 2007, 7:33 pm
Microsoft fixes imperfect picture flaw November 8, 2005, 10:21 pm
Flaw finders lay siege to Microsoft Office July 24, 2006, 10:25 pm
Security Flaw: Any website can read your clipboard text September 18, 2005, 9:58 am

The site map in XML format XML site map

Contact Us | Privacy Policy