{"id":3047,"date":"2024-11-26T10:41:09","date_gmt":"2024-11-26T08:41:09","guid":{"rendered":"https:\/\/certitude.consulting\/blog\/?p=3047"},"modified":"2024-11-26T10:41:10","modified_gmt":"2024-11-26T08:41:10","slug":"exploring-anti-phishing-measures-in-microsoft-365-pt-2","status":"publish","type":"post","link":"https:\/\/certitude.consulting\/blog\/en\/exploring-anti-phishing-measures-in-microsoft-365-pt-2\/","title":{"rendered":"Exploring Anti-Phishing Measures in Microsoft 365 – Pt. 2"},"content":{"rendered":"\n

In a previous blog post<\/a>, we described an issue with the “First Contact Safety Tip” which allowed it to be bypassed by malicious actors. Recently, we discovered that Microsoft modified the disclaimer to better resist the described attack. In this blog post, we discuss these changes, and whether it is still possible to carry out the same attack.<\/strong><\/p>\n\n\n\n

We recently discovered that the “First Contact Safety Tip” had been modified, so that the proof of concept that previously worked no longer functioned correctly:<\/p>\n\n\n\n

\"\"
Figure 1: The “First Contact Safety Tip” is only partly affected by the POC used in the previous blog post.<\/em><\/figcaption><\/figure>\n\n\n\n

To understand why the POC no longer works, we need to take a look at the source code to see what has changed. Shown below is a “First Contact Safety Tip” from an email sent in August 2024, next to the same disclaimer from an email sent in September 2024:<\/p>\n\n\n\n

\"\"
Figure 2: On the left is the ‘First Contact Safety Tip’ from an email sent on 02.08.2024. On the right is the same disclaimer from an email sent on 04.09.2024.<\/em><\/figcaption><\/figure>\n\n\n\n

The difference between the two, are the various style<\/code> attributes, also targeting elements which previously had no style<\/code> attribute. The new style<\/code> attributes each follow a similar pattern; a long block of revert<\/code><\/strong> clauses has been prepended to the original style, as well as heavy use of the !important<\/code><\/strong> keyword. For example, shown below is the new content of the style<\/code> attribute for the table<\/code> element, with the reverting clauses highlighted in yellow:<\/p>\n\n\n\n

style=\" aspect-ratio: revert !important; background: revert !important; block-size: revert !important; border: revert !important; bottom: revert !important; color: revert !important; color-scheme: revert !important; content-visibility: revert !important; cursor: revert !important; direction: revert !important; display: revert !important; font-size: revert !important; height: revert !important; hyphens: revert !important; letter-spacing: revert !important; line-height: revert !important; margin: revert !important; opacity: revert !important; order: revert !important; outline: revert !important; overflow: revert !important; padding: revert !important; position: revert !important; resize: revert !important; rotate: revert !important; scale: revert !important; tab-size: revert !important; table-layout: revert !important; text-align: revert !important; text-indent: revert !important; text-orientation: revert !important; text-overflow: revert !important; text-shadow: revert !important; text-transform: revert !important; text-wrap: revert !important; top: revert !important; transition: revert !important; user-select: revert !important; vertical-align: revert !important; visibility: revert !important; white-space: revert !important; width: revert !important; word-break: revert !important; word-spacing: revert !important; writing-mode: revert !important; zoom: revert !important;<\/mark> cellpadding: 0 !important; border: 0 !important; cellspacing: 0 !important; display: table !important; width: 100% !important; table-layout: fixed !important; border-collapse: seperate !important; float: none !important; border-spacing: 0px 0px !important; \"\n            align=\"left\"<\/code><\/pre>\n\n\n\n
What does revert<\/code> do, and why are there so many of them now?<\/strong> Well, according to the relevant MDN Web Docs<\/a> article, revert<\/code> is a CSS keyword which “reverts the cascaded value of the property from its current value to the value the property would have had if no changes had been made by the current style origin to the current element”<\/em>. This keyword may be applied to any CSS property.<\/p>\n\n\n\n
What about !important<\/code>?<\/strong> According to another MDN Web Docs<\/a> article, !important<\/code> is a CSS keyword which can be used to override other CSS declarations which would otherwise apply to an element based on specificity.<\/p>\n\n\n\n
Visually, there is no difference between the old and new “First Contact Safety Tip” (see below). A distinction is only noticed, when attempting to alter the appearance of this disclaimer with custom CSS rules, as was demonstrated in Figure 1.<\/p>\n\n\n\n
\"\"
Figure 3: The older “First Contact Safety Tip” is shown above (1). Below is the newer version (2).<\/em><\/figcaption><\/figure>\n\n\n\n
So, is it still possible to alter\/hide the “First Contact Safety Tip”, despite the changes which have been made?<\/strong> In Fig. 1, we already saw that the POC was not completely mitigated, since the text was effectively hidden, but we could not find a way to go further than this<\/strong>. Meaning at least the gray bar is always visible. However, an attacker may e.g. choose to set the background of the e-mail to the same gray. This might make it harder for a victim to notice something to be off:<\/p>\n\n\n\n
\"\"
Figure 4: Bypass using gray background.<\/em><\/figcaption><\/figure>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
In a previous blog post, we described an issue with the “First Contact Safety Tip” which allowed it to be bypassed by malicious actors. Recently, we discovered that Microsoft modified the disclaimer to better resist the described attack. In this blog post, we discuss these changes, and whether it is still possible to carry out […]<\/p>\n","protected":false},"author":18,"featured_media":3183,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[60,103],"tags":[524,520,440,318],"class_list":["post-3047","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technical-analysis","category-vulnerability-research-en","tag-microsoft-en","tag-outlook","tag-phishing-en","tag-social-engineering"],"_links":{"self":[{"href":"https:\/\/certitude.consulting\/blog\/wp-json\/wp\/v2\/posts\/3047","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/certitude.consulting\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/certitude.consulting\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/certitude.consulting\/blog\/wp-json\/wp\/v2\/users\/18"}],"replies":[{"embeddable":true,"href":"https:\/\/certitude.consulting\/blog\/wp-json\/wp\/v2\/comments?post=3047"}],"version-history":[{"count":9,"href":"https:\/\/certitude.consulting\/blog\/wp-json\/wp\/v2\/posts\/3047\/revisions"}],"predecessor-version":[{"id":3263,"href":"https:\/\/certitude.consulting\/blog\/wp-json\/wp\/v2\/posts\/3047\/revisions\/3263"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/certitude.consulting\/blog\/wp-json\/wp\/v2\/media\/3183"}],"wp:attachment":[{"href":"https:\/\/certitude.consulting\/blog\/wp-json\/wp\/v2\/media?parent=3047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/certitude.consulting\/blog\/wp-json\/wp\/v2\/categories?post=3047"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/certitude.consulting\/blog\/wp-json\/wp\/v2\/tags?post=3047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}