A bug in Microsoft Office 365 Message Encryption (OME) could expose email content to threat actors.

WithSecure, formerly known as F-Secure Business, released advisory warning organizations of a security flaw in OME and emphasized that there’s no patch currently available to fix the bug.

OME utilizes the Electronic Codebook (ECB) implementation – a mode of operation known to leak certain structural information about messages.

“Since the encrypted messages are sent as regular email attachments, the messages sent may be stored in various email systems and may have been intercepted by any party between the sender and the recipient,” the advisory reads.

Upon obtaining enough OME emails, attackers could analyze the location and frequency of repeated patterns in individual messages and match them to ones found in other OME emails and files. As a result, threat actors could use the leaked information to partially or fully infer the contents of the messages.

“Attackers who are able to get their hands on multiple messages can use the leaked ECB info to figure out the encrypted contents,” WithSecure security researcher Harry Sintonen said. “More emails make this process easier and more accurate, so it’s something attackers can perform after getting their hands on email archives stolen during a data breach, or by breaking into someone’s email account, email server or gaining access to backups.”

WithSecure informed Microsoft about the vulnerability and, after repeated queries, got the following response: “The report was not considered meeting the bar for security servicing, nor is it considered a breach. No code change was made, so no CVE was issued for this report.”

Since there’s no patch available yet, the only mitigation, WithSecure said, is to avoid using MS 365 Message Encryption.

Microsoft paid Sintonen via their bug bounty program. However, the company opted out of fixing the issue.

According to the advisory, an attacker could compromise backlogs or archives of the previous message since the analysis can be done offline.

“Any organization with personnel that used OME to encrypt emails is basically stuck with this problem. For some, such as those that have confidentiality requirements put into contracts or local regulations, this could create some issues. And then, of course, there are questions about the impact this data could have in the event it’s actually stolen, which makes it a significant concern for organizations,” said Sintonen.

Original Posts: Microsoft Office 365 Message Encryption flaw exposes email content