Microsoft Outlook displays full contact details for spoofed senders

Product harvests details from Active Directory without checking, say researchers

Cyber security research company Avanan has highlighted an omission in Outlook that it says renders the product vulnerable to phishing techniques.

In a blog post published today, the Check Point-owned company said that the Microsoft email client would display extensive details about spoofed email senders without authenticating the email first.

An attacker can send a spoofed email to the target, pretending to be from someone in the organization. The organization's Outlook client then looks up the spoofed sender's details in the company's Active Directory instance, filling in extra details for their identity.

Those details include photos, files shared between users, legitimate email addresses, and phone numbers. They can also see all of their previous communications with the spoofed colleague, creating a convincing listing in the victim's Outlook client that gives the spoofed email greater credibility.

The attack can be used for typical phishing purposes including credential harvesting.

According to Avanan's researchers, Outlook does not authenticate emails using technologies like the Sender Policy Framework (SPF) or DomainKeys Identifed Mail (DKIM). Instead, it leaves this to security tools that analyze emails before they reach a user's inbox.

Related Resource

Protecting every edge to make hackers’ jobs harder, not yours

How to support and secure hybrid architectures

White square with whitepaper title on top of a background image of a building and pavementFree download

SPF is a record listing IP addresses that are authorized to send emails from a domain, while a DKIM check allows an email's sender to sign it with a private key that the receiving software can then check.

To take advantage of this technique, the hacker must first successfully spoof the target organization's domain in a way that gets past anti-phishing scanners (assuming they have them).

"Spoofing is also made easier because Microsoft does not require verification before updating the user image on an email," Avanan's researchers said. "It will display all contact data for a user, even if that user has an SPF fail."

Microsoft users have asked about DKIM and SPF checks in Outlook on Microsoft's technical forum for Outlook Desktop, but with little success.

To resolve these issues, Avanan recommends that organizations use layered security to analyze mails before the inbox, checking for malicious files and links. They should also check a domain's reputation and run an SPF and DKIM check.

The Domain-based Message Authentication, Reporting & Conformance (DMARC) policy, built on SPF and DKIM, helps here. It links to the From: domain, and supports policies for recipient handling of authentication failures, along with reporting to senders. Avanan also recommends that admins protect any applications interacting with Active Directory.

In September, another researcher noted that Outlook would display a person's real contact details even if a phishing email used a homograph-based domain that looked similar to a legitimate one.

Featured Resources

How virtual desktop infrastructure enables digital transformation

Challenges and benefits of VDI

Free download

The Okta digital trust index

Exploring the human edge of trust

Free download

Optimising workload placement in your hybrid cloud

Deliver increased IT agility with the cloud

Free Download

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Download now

Recommended

Microsoft tells IT admins to turn off legacy group policies to improve Windows performance
Microsoft Windows

Microsoft tells IT admins to turn off legacy group policies to improve Windows performance

21 Jan 2022
Microsoft buys game developer Activision Blizzard for $68.7 billion
mergers and acquisitions

Microsoft buys game developer Activision Blizzard for $68.7 billion

18 Jan 2022
Microsoft takes aim at critical RCE flaws with "massive" Patch Tuesday update
cyber security

Microsoft takes aim at critical RCE flaws with "massive" Patch Tuesday update

12 Jan 2022
Windows 11 problems and how to fix them
Microsoft Windows

Windows 11 problems and how to fix them

7 Jan 2022

Most Popular

How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

4 Jan 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

6 Jan 2022
Microsoft Exchange servers break thanks to 'Y2K22' bug
email delivery

Microsoft Exchange servers break thanks to 'Y2K22' bug

4 Jan 2022