IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Microsoft Outlook displays full contact details for spoofed senders

Product harvests details from Active Directory without checking, say researchers

Cyber security research company Avanan has highlighted an omission in Outlook that it says renders the product vulnerable to phishing techniques.

In a blog post published today, the Check Point-owned company said that the Microsoft email client would display extensive details about spoofed email senders without authenticating the email first.

An attacker can send a spoofed email to the target, pretending to be from someone in the organization. The organization's Outlook client then looks up the spoofed sender's details in the company's Active Directory instance, filling in extra details for their identity.

Those details include photos, files shared between users, legitimate email addresses, and phone numbers. They can also see all of their previous communications with the spoofed colleague, creating a convincing listing in the victim's Outlook client that gives the spoofed email greater credibility.

The attack can be used for typical phishing purposes including credential harvesting.

According to Avanan's researchers, Outlook does not authenticate emails using technologies like the Sender Policy Framework (SPF) or DomainKeys Identifed Mail (DKIM). Instead, it leaves this to security tools that analyze emails before they reach a user's inbox.

Related Resource

Protecting every edge to make hackers’ jobs harder, not yours

How to support and secure hybrid architectures

White square with whitepaper title on top of a background image of a building and pavementFree download

SPF is a record listing IP addresses that are authorized to send emails from a domain, while a DKIM check allows an email's sender to sign it with a private key that the receiving software can then check.

To take advantage of this technique, the hacker must first successfully spoof the target organization's domain in a way that gets past anti-phishing scanners (assuming they have them).

"Spoofing is also made easier because Microsoft does not require verification before updating the user image on an email," Avanan's researchers said. "It will display all contact data for a user, even if that user has an SPF fail."

Microsoft users have asked about DKIM and SPF checks in Outlook on Microsoft's technical forum for Outlook Desktop, but with little success.

To resolve these issues, Avanan recommends that organizations use layered security to analyze mails before the inbox, checking for malicious files and links. They should also check a domain's reputation and run an SPF and DKIM check.

The Domain-based Message Authentication, Reporting & Conformance (DMARC) policy, built on SPF and DKIM, helps here. It links to the From: domain, and supports policies for recipient handling of authentication failures, along with reporting to senders. Avanan also recommends that admins protect any applications interacting with Active Directory.

In September, another researcher noted that Outlook would display a person's real contact details even if a phishing email used a homograph-based domain that looked similar to a legitimate one.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

Microsoft to double salary budget to retain workers
Careers & training

Microsoft to double salary budget to retain workers

17 May 2022
Microsoft warns of new botnet variant targeting Windows and Linux systems
Security

Microsoft warns of new botnet variant targeting Windows and Linux systems

16 May 2022
Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022
Actively exploited Windows vulnerability reaches peak severity when paired with popular attack
Security

Actively exploited Windows vulnerability reaches peak severity when paired with popular attack

11 May 2022

Most Popular

Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022
Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
IT admin deletes company’s databases and is jailed for seven years
Policy & legislation

IT admin deletes company’s databases and is jailed for seven years

16 May 2022