Security Flaw with Digital signatures in Microsoft Outlook
Roberto Franceschetti reports on the Bugtraq mailing list: On 10/21/2004 the following vulnerability was reported to Microsoft:
Security Flaw with Digital signatures in Microsoft Outlook -
Emails in Microsoft Outlook digitally signed with S/MIME using either a commercial personal certificate like Verisign or using a certificate issued by
MS Certificate Server can be altered. Outlook will not show any warnings about the email being changed, the digital signature will still be reported
valid even though the message content has been modified and parties involved in the signatures changed. This is an extremely serious flaw as I can
change any digitally signed emails I want without Outlook ever noticing. After several emails with Microsoft and CERT during the months that followed,
no fixes have been issued to correct this security flaw. It is only now that I am making this information public after all my attempts to have
Microsoft resolve the problem have failed.
The following are 3 digitally signed messages. The 1st one is a valid, unmodified email from Roberto Franceschetti (roberto@logsat.com) to
support@logsat.com: (follow the hyperlinks for the email's source and screenshots)
The following one has been "hacked" so that the sender now appears to be "Hackers Franceschetti" (hackers@logsat.com). Note that Outlook states that
the email is absolutely valid, and that the certificate is Valid and Trusted. This is most definitely not the case, as I've altered the original
message to make it appear as a different person actually sent it. Imagine the scenario where a digital signature is supposed to unequivocally identify
a sender, but now this email that appears to be sent by "hackers" appears legitimate, and a poor victim will trust it and send the hacker any
confidential information he is asked for... (follow the hyperlinks for the email's source):
This 3rd email is yet another variation showing how a digitally signed email can further be forget without Outlook ever raising warning flags (follow
the hyperlinks for the email's source):
