bugtraq - Re: Security Flaw with Digital signatures in Microsoft Outlook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050329041821.30971.qmail@www.securityfocus.com>
Date: 29 Mar 2005 04:18:21 -0000
From: <dori@...can.co.il>
To: bugtraq@...urityfocus.com
Subject: Re: Security Flaw with Digital signatures in Microsoft Outlook

In-Reply-To: <20050325202052.15663.qmail@....securityfocus.com>

Mr Roberto managed to change email headers – “from address”.

Security Professionals know the email headers can't be trusted and can be easily forged.
Most Outlook users *do not*.

The “signed by” and the certificate signer remain valid – so its issue of educating users to look at the "signed by" field , and not the from address.

This "Feature / Flaw" can be the source of some problematic phishing scams:
if i buy a certificate for some-user@...pany.com
and send a forged email with "from" helpdesk@...pany.com, signed by that some-user@...pany.com
I'm sure it can get the passwords from most of the users.

I'm sure some ppl will take this further and we are going to see this trend in phishing evolving quickly.

Dori Fisher,
We! Consulting group.