Impersonation bug could have security implications for 400 million Outlook users
A security researcher has issued a warning to all 400 million users of Microsoft Outlook after discovering an email bug that could allow anyone to impersonate official Microsoft accounts.
Vsevolod Kokorin, a security researcher at SolidLab, posted a message on X, formerly known as Twitter, expressing frustration with Microsoft after he had uncovered and responsibly disclosed a serious vulnerability impacting Outlook email, only to be told it couldn’t be reproduced.
The bug, which Kokorin rightly refuses to provide the technical details needed to exploit it at this time, enables anyone sending an email to another Outlook user to impersonate official Microsoft corporate accounts. As shown in the example posted to X, this means an email can appear to come from Microsoft’s security team, with all the implications for phishing, malware distribution and cybercrime that brings with it.
How To Mitigate The Risk Of New Outlook Spoofing Bug
While the vulnerability only appears to be exploitable when sending email from one Outlook user to another, given that there are around 400 million users it creates a huge threat surface.
Kokorin reached out to TechCrunch which has confirmed it received a spoofed email that did, indeed, appear to genuinely be from the Microsoft security team.
I have contacted Microsoft for a statement and will update this article in due course. Meanwhile, however, if you are an Outlook email user then it’s highly recommended that you stay alert to any requests you might receive that appear to be from Microsoft.
In an update to his original posting, Kokorin said of Microsoft that “at this point, they have acknowledged the issue,” which could mean a patch will be forthcoming if the vulnerability is found to be fixable. I sincerely hope it is, as Kokorin also said that the emails being spoofed passed the DMARC authentication tests that are meant to prevent just such a security threat.