MS Outlook digital sigs easily forged (Want to be Bill Gates?)

The Register (U.K.) ^ | 09/02/2002 | Thomas C Greene

[Fractal Trader]

Digital signatures can easily be forged and therefore can't be trusted in Outlook because of the same certificate chaining issue plaguing Internet Explorer, researcher Mike Benham says.

Benham is responsible for discovering and publicizing the IE debacle, where SSL certs can be signed by an untrusted intermediary without warning to the end user, as we reported earlier.

Now after a bit of further tinkering it appears that the same design flaw can be used against Outlook users. Briefly, an attacker would sign an untrusted cert with a trusted, intermediate one. Of course, just because the cert doing the signing is trusted, that's no reason why its offspring should be. Unfortunately, neither IE nor Outlook check basic constraints, and for this reason the end user is never warned that the certificate chain is questionable.

Meanwhile, Benham has obtained a valid certificate and key with which these two issues can be verified. The goodies are now bundled in the latest version of SSLsniff.

"As it stands, there is virtually no difference between signed and unsigned email in Outlook. Unless carefully inspected, signed email in Outlook is essentially meaningless. This also applies to any signed email received over the past 5+ years," Benham says.

Now all we've got left to worry about is a similar exploit involving code-signing certificates.

For step-by-step breakdown on the misuse of digital certs against Outlook users, see Benham's latest BugTraq post. He recommends sending Billg a spoofed, digitally signed e-mail from himself to illustrate the danger. ®

[Fractal Trader]

I always thought the digital signatures on emails were pretty bogus anyway, with emails being so susceptible to spoofing. Now, we find out that we can send out email with a digital signature attesting that we are Bill Gates!

Where is that SSL patch, Microsoft, that all other browsers have managed to fix?

[egarvue]

I am by no means a Microsoft basher (working on their products provides me and my family with a living), but Outlook frankly stinks. It is bloated and scarily insecure, I quit using it a while ago. I use Poco Mail for my email now - nice, small, powerful, and not subject to Outlook viruses.