This Microsoft 365 flaw could let ransomware hit OneDrive and SharePoint

(Image credit: Shutterstock)

A “potentially dangerous” piece of functionality recently discovered in Office 365 could allow threat actors to encrypt cloud-hosted files and make them unrecoverable without a dedicated backup solution, or a decryption key.

Cybersecurity researchers from Proofpoint claim the “AutoSave” feature, which automatically saves documents being worked on to the cloud can be abused by the flaw.

AutoSave is a pretty self-explanatory tool. Every now and then, the documents being worked on get saved to the cloud. The authors, collaborators, and file owners can later access these older versions, giving them a window of opportunity in case of a ransomware attack.

Microsoft disagrees

However, should a threat actor obtain access to the victim’s cloud (which happens all the time, through social engineering), they can do one of two things: either limit the number of autosaves to just one, or trigger the autosave feature 500 times, which is the tool’s maximum.

The latter, however, isn’t that feasible, Proofpoint claims: “Encrypting files 500+ times is unlikely to be seen in the wild. It requires more scripting and more machine resources while making your operation easier to detect,” the announcement reads.

Still, in both scenarios, the collaboration platform will stop making saves after that, and should the attacker encrypt it at that time, the victim would have no other option but to revert to an air-gapped backup, or pay for a decryption key.

> What is phishing and how dangerous is it?

> Everything you need to know about phishing

> How to avoid online phishing to better protect yourself

While Proofpoint believes this to be a weak point in the tool, Microsoft disagrees. After being informed of the findings, the Redmond giant said the tool works as intended. Microsoft also told Proofpoint that should something like this really happen, its customer support can restore files up to 14 days old. Proofpoint, on the other hand, says it tried this method and it doesn’t work.

To keep your endpoints safe from ransomware and malware, you should always keep both software and hardware up to date, set up strong cybersecurity protections and firewalls, and educate your employees on the dangers of phishing and other forms of social engineering.

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.