Category Archives: What have I discovered?

Microsoft, you have a problem

Recently (some will say – for many years by now) Microsoft is being criticized for its Information Security capabilities, as that it is slow to do the move from on-premises products security to also, in addition, a cloud provider security, which is, in my opinion, even harder.

This is my recent incident about it:

I recently accepted an email from one of Microsoft’s sub domains.

I use a commercial cloud email security service to protect my email traffic, and this system stopped this email from entering because the sub domain did not have any SPF record, so my email security service stopped this email as a possible email impersonating to be from Microsoft).

This sub domain still doesn’t have an SPF record, as I write this.

It is not a big security issue, but I know that if I was in charge of this online asset and I had such an issue – I will be glad if someone would alert me about it, so I tried to find a way to report this to Microsoft, but I did not find any explicit content directing where to report online security issues, so I opened a case at MSRC (Microsoft Security Response Center)

I am aware it is not a vulnerability but a missing security measure that MS better fix and I had no better place to report this to MS.

This is the response I got as my report was set by the MSRC analyst to a status of “This closed as a non-MSRC case.” (the bold text was highlighted by me):


Hello,

Thank you for contacting the Microsoft Security Response Center (MSRC). We appreciate the time taken to submit this assessment.

Upon investigation we have determined that this does not meet the definition of a security vulnerability.

The website you reported does not contain a MX record, which indicates we do not use the domain to send email messages.  In which case SPF/DMARC records are not considered required and would not meet the bar for security servicing.

As such, this thread is being closed and no longer monitored. We apologize for any inconvenience this may have caused.

If you believe this to be a misunderstanding of the report, submit a new report at https://aka.ms/secure-at

Please include:

Relevant information previously provided in your initial report
Detailed steps required to consistently reproduce the issue
Short explanation on how an attacker could use the information to exploit another user remotely
Proof-of-concept (POC), such as a video recording, crash reports, screenshots, or relevant code samples

For more information on what qualifies as a security vulnerability please see the following:
Definition of a Security Vulnerability: https://www.microsoft.com/msrc/definition-of-a-security-vulnerability

We thank you again for taking the time to submit this report!

Regards,

<name of the analyst>
MSRC

This is sad for at least two reasons:

  1. The core claim of the analyst is simply not true, technically – ” The website you reported does not contain a MX record, which indicates we do not use the domain to send email messages.  In which case SPF/DMARC records are not considered required and would not meet the bar for security servicing.”.
    MX record is for accepting emails. It can be absent and still it is possible to send emails from the relevant sub domain. Email sending and receiving works independently of each other.
    Hence, the core claim to block my report was based on mistaken or unknowledgeable information.
  2. I know it is not a vulnerability, but I guess MS should be happy to get any information that let it know it is missing a basic security measure, even if it is regarding an online attribute of it, not of a software product vulnerability

If Microsoft put at its MSRC frontline an analyst with such level of understanding how email works – then Microsoft really, really, have a problem.

And no, I will not open a new case at MSRC to prove them wrong. I will just go on with my life and Microsoft will need to live with the consequences of how it operates.

I will not make the extra mile effort when MS doesn’t even do the basics.

Microsoft Office 365 blocking access to sites with digital certificate issues – is not working

Dig this – a bonus for you, my loyal readers… 🙂

Do not click on this link – https://2.21.143.74. It is the IP address of microsoft.com (the IP itself is of Akamai). Copy it to a clean Word document or clean Excel worksheet (make sure the apps are using the latest version of 365). Make sure the text becomes a link. Click on the link. A warning message will appear as in the attached image, stating that there is no match between the site you requested (because you requested an IP address) and the name of the site for which the certificate is intended (microsoft.com).

If you click “No” or the “X” button for closing the warning message window or even typing the keyboard combination of Alt+F4 to close the Word/Excel app – the link will open anyway … only killing the Winword.exe process for Word or Excel.exe for Excel – will cause the link not to open…

Also notice that the default focus in the warning window is on the “No” button, so a user’s automatic action (hitting “Enter” or “Space” on the keyboard or clicking the mouse main button, if the cursor feature of “Snap to default” is enabled) will cause the site to be opened instead of avoiding the site. That means that this protection does not work.

I contacted the MSRC with the above information, and they responded as follows:

Hello Eitan,
Thank you for submitting this issue to MSRC. We determined that while the issue you reported is valid, it does not meet our the bar for immediate servicing. That being said, this submission has been flagged for future review by the product team as an opportunity to improve the security of the affected product. We do not have a timeline for when this review will occur, and will not be able to provide status for this issue moving forward.

New page added – Findings and honors

I have added a new page to the site, called “Findings and honors“.
This page list all the Information Security vulnerabilities and other issues that I have discovered in my long career, including the last occasion – being added to the Israeli government “Hall of fame” for security researches who reported exposures in the Israel digital infrastructure.
I hope to extend this list in years to come… 😉