Re: [bugtraq] Security Flaw with Digital signatures in Microsoft Outlook

[Erwann ABALEA <erwann.abalea () certplus com>]

Bonjour,

Hodie VIII Kal. Apr. MMV est, Roberto Franceschetti scripsit:
> The following one has been "hacked" so that the sender now appears to be "Hackers Franceschetti" (hackers () logsat 
> com). Note that Outlook states that the email is absolutely valid, and that the certificate is Valid and Trusted. 
> This is most definitely not the case, as I've altered the original message to make it appear as a different person 
> actually sent it. Imagine the scenario where a digital signature is supposed to unequivocally identify a sender, but 
> now this email that appears to be sent by "hackers" appears legitimate, and a poor victim will trust it and send the 
> hacker any confidential information he is asked for... (follow the hyperlinks for the email's source):

It is clearly indicated "Signed by: roberto () logsat com", what's the
problem? (see below)

> Screenshot at http://www.logsat.com/Signatures/Hacked1.gif
> Email's source at http://www.logsat.com/Signatures/Hacked1.msg

It's not an email, it's a binary message that can be opened only by
Microsoft Outlook. Could you please provide pure text messages? Same
request for your conversation between MS, CERT, and you.

> This 3rd email is yet another variation showing how a digitally signed email can further be forget without Outlook 
> ever raising warning flags (follow the hyperlinks for the email's source):

In your 2 examples, you aparently fail to notice that the envelope of
the message is not signed *at all*. What you're modifying in precisely
this envelope. What is really signed is the *body* of the message,
that's all. If you change the "From" address, or the subject, or the
sending date, that won't invalidate the signature.

I don't like to say this, but here, Microsoft did something useful for
the end user, by clearly displaying the identity of the signer, along
with the declared identity of the sender. If you want them to do more,
that's something else. But cryptographically speaking, the signatures
haven't been invalidated by your manipulations.

> The full emails with the conversations between myself, Microsoft and CERT can be found here 
> (http://www.logsat.com/Signatures/emails.asp). I hope that by making this information public all the users who rely 
> on digital signatures will be aware of this severe security flaw in Microsoft Outlook, and will take other 
> precautions to ensure the identity of users in digitally signed emails they receive.

Could you reformat your web page? It's difficult to read, and .msg
files don't fit my Linux machine.

-- 
Erwann ABALEA <erwann.abalea () keynectis com>