This Microsoft 365 flaw could let ransomware hit OneDrive and SharePoint
AutoSave feature could allow hackers to encrypt Microsoft 365 flaw cloud files
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A “potentially dangerous” piece of functionality recently discovered in Office 365 could allow threat actors to encrypt cloud-hosted files and make them unrecoverable without a dedicated backup solution, or a decryption key.
Cybersecurity researchers from Proofpoint claim the “AutoSave” feature, which automatically saves documents being worked on to the cloud can be abused by the flaw.
AutoSave is a pretty self-explanatory tool. Every now and then, the documents being worked on get saved to the cloud. The authors, collaborators, and file owners can later access these older versions, giving them a window of opportunity in case of aransomwareattack.
(ed: Check out our comparisons:Microsoft OneDrive vs Google Drive,Microsoft OneDrive vs DropboxandMicrosoft OneDrive vs iCloud)
Share your thoughts on Cybersecurity and get a free copy of the Hacker’s Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at theend of this surveyto get the bookazine, worth $10.99/£10.99.
Microsoft disagrees
However, should a threat actor obtain access to the victim’s cloud (which happens all the time, through social engineering), they can do one of two things: either limit the number of autosaves to just one, or trigger the autosave feature 500 times, which is the tool’s maximum.
The latter, however, isn’t that feasible, Proofpoint claims: “Encrypting files 500+ times is unlikely to be seen in the wild. It requires more scripting and more machine resources while making your operation easier to detect,” the announcement reads.
Still, in both scenarios, the collaboration platform will stop making saves after that, and should the attacker encrypt it at that time, the victim would have no other option but to revert to an air-gapped backup, or pay for a decryption key.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
What is phishing and how dangerous is it?>Everything you need to know about phishing>How to avoid online phishing to better protect yourself
While Proofpoint believes this to be a weak point in the tool,Microsoftdisagrees. After being informed of the findings, the Redmond giant said the tool works as intended. Microsoft also told Proofpoint that should something like this really happen, its customer support can restore files up to 14 days old. Proofpoint, on the other hand, says it tried this method and it doesn’t work.
To keep yourendpointssafe from ransomware andmalware, you should always keep both software and hardware up to date, set up strongcybersecurity protectionsand firewalls, and educate your employees on the dangers of phishing and other forms of social engineering.
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new malware utilizes a rare programming language to evade traditional detection methods
A new form of macOS malware is being used by devious North Korean hackers
Arcane season 2 confirms the hit series isn’t just one of the best Netflix shows ever made – it’s an animated legend that’ll stand the test of time
