#Cryptofail can happen for larger organizations, too: #Microsoft #Office365 email message #encryption (#OME) uses AES cipher in Electronic Code Book (#ECB) mode of operation for protecting the OME encrypted messages.
The ECB mode encrypts plaintext blocks independently, without randomization; therefore, the inspection of any two ciphertext blocks reveals whether or not the corresponding plaintext blocks are equal. What this means is that repeating parts of the message get encrypted to identical values revealing structure of the messages. It also will allow creating “fingerprints” of messages, where the relationship of repeating patterns can be used to infer similarity of different messages.
To make matters worse, in addition of keeping the encrypted message in the email server itself, OME by default also sends the encrypted message as an attachment to the recipient. While email typically does best-effort TLS encryption, in practice email transmission cannot really be considered secure. In practice this means that the poorly encrypted messages can be analyzed by anyone who ever managed to intercept the email message or happens to run into any of the OME encrypted messages at a later date. This allows actors who either have large collection of email traffic or who can access the email messages to analyze messages after the fact.
When I approached Microsoft about this flaw, they awarded me $5000 bug #bounty and then proceeded to do nothing. As far as I know the flaw is still present in Office 365 today. I have no clue why Microsoft refuses to fix this flaw, but I presume the reason is that it would break backwards compatibility.
The included sample images and the corresponding “encrypted” version of it were procured by sending an OME protected message with Outlook and then extracting the image from the RPMSG attachment.
#mistakesweremade #epicfail