Light

Episode #893 Quiz

Password Change Automation
Date: 2022-10-18 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Microsoft left Office 365 Message Encryption using ECB, leaking repeated plaintext patterns so archived emails can be analyzed offline without keys or BYOK. Separately, Windows driver blocklists for HVCI and ASR failed to update for years, enabling BYOVD attacks. A new .well-known change-password URL standard may streamline password page discovery and automation.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific weakness made Microsoft Office 365 Message Encryption vulnerable to offline analysis?

Question 1

According to the episode, what specific weakness made Microsoft Office 365 Message Encryption vulnerable to offline analysis?

It used Electronic Codebook mode, which preserves repeated block patterns It used CBC without an initialization vector, which repeated ciphertext across sessions It reused a fixed HMAC key, which let attackers verify message contents by comparison It exposed decrypted message metadata through a public API endpoint

Question 2: What did WithSecure say about the practicality of exploiting the Office 365 Message Encryption issue?

Question 2

What did WithSecure say about the practicality of exploiting the Office 365 Message Encryption issue?

Attackers needed live access to the sender's mailbox to decode each message Attackers could analyze stolen or archived messages offline without knowing the encryption key Attackers had to recover Microsoft’s master key to decrypt each message Attackers could only exploit the flaw if BYOK was not enabled

Question 3: What did Microsoft do after being told about the Office 365 Message Encryption flaw in January 2022?

Question 3

What did Microsoft do after being told about the Office 365 Message Encryption flaw in January 2022?

They acknowledged it, paid the researcher, and opted not to fix it They disabled OME entirely until a replacement was ready They patched OME and changed it to CBC with fresh IVs They denied the report and said the encryption was unaffected

Question 4: What was the core failure in Microsoft's driver-blocklist protection against BYOVD attacks?

Question 4

What was the core failure in Microsoft's driver-blocklist protection against BYOVD attacks?

ASR worked only for unsigned drivers, so signed drivers remained unfiltered by design HVCI prevented all kernel drivers from loading on Windows 10 The blocklist was not properly downloaded and applied through Windows Update Signed drivers were automatically revoked at the certificate authority

Question 5: What local-account hardening did Microsoft add in the October 11, 2022 updates for new machines?

Question 5

What local-account hardening did Microsoft add in the October 11, 2022 updates for new machines?

They required biometric enrollment before the first administrator login They enforced password complexity requiring three of four character classes They enabled mandatory account lockout after repeated failed administrator logins They disabled local administrator accounts during initial setup

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.