Virgin Media Virgin Media Community

ravenstar68 · ‎01-06-2024

Before I start I'm going to state that any and all opinions in here are my own and do not represent the opinions of either Virgin Media, OR any other company that I work for.

I have an office 365 subscription and Outlook on my MacBook is now the New Outlook.

I run my own email server and the New Outlook does not like setting up my account as an MS Exchange account so I reverted to the IMAP/SMTP combination to add my mail.

I noticed that my account was allowing the inbox set up to separate Focused and Other mail views - which I thought was Welcome - but strange, as this is a function on Microsoft Exchange accounts on the old Outlook but NOT IMAP accounts.

However the fun started when I wanted to look at the message source of a spam email. Whilst not intuitive, this turned out to be quite simple, right click on the message in the message list and select view source. This opened the message source in TextEdit. But something looked odd so I tried again with the message source from a big provider. Here are the main headers

From: EA <EA@e.ea.com>
To: "myaddress@timothydutton.co.uk" <myaddress@timothydutton.co.uk>
Subject: Order Confirmation

The first thing I noticed was that there were no Authentication results. Now as this is my server I know what checks it does and how they show up in the headers. So I decided to look at the same source in the Mac Mail Client.

From: "EA" <EA@e.ea.com>
To: <myaddress@timothydutton.co.uk>
Subject: Order Confirmation

So straight away we see a discrepancy. The DKIM header is there as is the result of the Authentication checks

Lets have a look at the plain text header portion

New Outlook

--_000_e2b2c4a7815e4e64bfe49242eac919f2atl1s07mta2749xtlocal_
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

Apple Mail

--WZDBQC32T1nn=_?:
Content-Type: text/plain;
	charset="utf-8"
Content-Transfer-Encoding: 8bit

There are more changes as well. So essentially I CANNOT trust the headers of the mail when viewed in the New Outlook client.

How does Microsoft Achieve this - well just as in the Outlook client on mobile devices, the client does not directly connect to your server. Instead it interacts with servers on Microsoft's network and they perform the IMAP and SMTP connections with the mail servers you set up in the settings. I've confirmed this by sending an email and checking the headers of the send to see the point where it hits my mail server.

Received: from CWXP265MB1542.GBRP265.PROD.OUTLOOK.COM (unknown [IPv6:2603:1026:401:4d::5])
	by mail.timothydutton.co.uk (Postfix) with ESMTPSA id 4Vrqsd4Bqhz4vym

I could possibly live with this, but I am not a fan of Microsoft essentially re-writing my mail - whilst the mail itself looks identical to the end viewer on both clients - being unable to provide the ORIGINAL source from the New Outlook app means that security professionals are hampered from doing their jobs properly when investigating email scams.

Whoever thought this was a good idea needs their heads examining.

I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media. Learn more

Have I helped? Click Mark as Helpful Answer or use Kudos to say thanks

用心棒 · ‎01-06-2024

I do not use Outlook but was curious enough to see what the issue could possibly be here. AFAICS it seems there is a “sanitised” view of headers that shows just the information Microsoft believe is of use. To access the “de-sanitised” view it seems you need to view the message's Properties > Internet headers field.

ravenstar68 · ‎01-06-2024

Nope it's not. The Properties->Internet Headers is in the Classic Version of Outlook. The New version aims to move the interface in a similar direction to that of Outlook on the Web.

I've just added the same account to New Outlook on Windows, and have had the same experience as on the MacBook Air.

In addition when the client is set up you get a notification that the account is being synced with the Microsoft Cloud - I don't recall the message being so Overt in the MacOS version.

However it doesn't just sync the message to the cloud, it converts it. Text in the email body that was encoded as 8 bit is instead encoded using Base64

This is with external accounts, but Microsoft has form for changing email bodies. If I send an email to an Exchange account and a Gmail account and then run DKimverify on the source, Microsoft fails DKIM but Gmail passes.

Remember DKIM not only signs the mail, but also provides a hash that is used to prove that specified parts of the mail have not been altered.

The thing is, if they can effectively amend the contents of the mail to change the encoding format, what's to stop them actually amending the actual viewable content of the message.

Tim

I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media. Learn more

Have I helped? Click Mark as Helpful Answer or use Kudos to say thanks

Adduxi · ‎01-06-2024

I’ve so far managed not to use the “new” outlook with MS365. I’m just waiting for MS to force all users onto it.

I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media. Learn more

Have I helped? Click Mark as Helpful Answer or use Kudos to say thanks

用心棒 · ‎01-06-2024

@ravenstar68 wrote:
Nope it's not. The Properties->Internet Headers is in the Classic Version of Outlook. The New version aims to move the interface in a similar direction to that of Outlook on the Web.
⋮

Sorry to read that.

Seems the instructions here, View internet message headers in Outlook - Microsoft Support, are incorrect then:

Tudor · ‎01-06-2024

When I see MS doing things like this I’m very glad I gave up on MS a few years ago. I had even been a beta tester for early versions of Window and Windows Network Server!

Tudor
There are 10 types of people: those who understand binary and those who don't and F people out of 10 who do not understand hexadecimal c1a2a285948293859940d9a49385a2

Virgin Media Virgin Media Community

Virgin Media Virgin Media Community

New Outlook Mac OS and Windows some thoughts.