19
In January 2022 I discovered that #Microsoft #Office365 Message #Encryption (OME) utilized Electronic Codebook (ECB) mode of operation. I reported this, got paid a $5000 bounty and then things fell dead silent. By autumn I tried to follow up on this, and after numerous attempts to inquire about the schedule for a fix I was told that no fix was planned.
Luckily, Microsoft seems to have changed their mind about this, and the fix was applied in late 2023, after all:
#vulnerability #infosec #cybersecurity
@[email protected] I remember this! Is this the security advisory? https://labs.withsecure.com/advisories/microsoft-office-365-message-encryption-insecure-mode-of-operation
@[email protected] Yep, that's the one.