The security nightmare known as the Outlook iOS and Android app

Forums › IT Pro and developers › The security nightmare known as the Outlook iOS and Android app

jarledb

Webhead
3319 posts

Uber Geek
+1 received by user: 1983

Moderator

ID Verified

Trusted

Lifetime subscriber

#163236 2-Feb-2015 21:46

Thought some of you might want to know about this incredible security hole, made possible by the new Outlook iOS and Android app.

In short: Microsoft stores usernames, passwords, emails and attachments for internal email systems when this service is used.

Microsoft Outlook app for iOS breaks your company security

If I was running a company email server I would block this system from accessing that server as quickly as possible.

Jarle Dahl Bergersen | Referral Links: Want $50 off when you join Octopus Energy? Use this referral code
Are you happy with what you get from Geekzone? Please consider supporting us by making a donation or subscribing.

charsleysa

597 posts

Ultimate Geek
+1 received by user: 125

#1229060 2-Feb-2015 22:27

No less secure than having a Gmail account.

For most companies this isn't even an issue, for those with high security needs they'll just block it.

That article just looks like scaremongering.

Might just be another case of read the description of the app before you use it.

Regards
Stefan Andres Charsley

gzt

18679 posts

Uber Geek
+1 received by user: 7820

Lifetime subscriber

#1230075 3-Feb-2015 00:45

It is an interesting article. Yes it's not different from Google markedly, but Microsoft customers are different and Microsoft has lost a bit of trust with this freer approach.

1101

3141 posts

Uber Geek
+1 received by user: 1143

#1230385 3-Feb-2015 11:47

If admins were TRUELY this concerned with security, they wouldnt be using Android anyway . Or laptops that users can take home/take offsite (& let there family & kids use)

nathan

5695 posts

Uber Geek
+1 received by user: 1630
Inactive user

#1230388 3-Feb-2015 11:48

Outlook for iOS & Android incorporates cloud services to improve app performance and provide advanced functionality including predictive search, recent attachments view, large attachment handling and more.

At launch, these cloud services are not covered under the Office 365 Trust Center, which provides security, privacy and compliance Information for Office 365 customers.

We will be updating Outlook later this year to enable it to be covered by the Office 365 Trust Center.

coffeebaron

6304 posts

Uber Geek
+1 received by user: 3567

Trusted

Lifetime subscriber

#1230402 3-Feb-2015 11:58

There reality is there are many exchange capable email clients out their that people could use and it would be the same issue.

Rural IT and Broadband support.

Broadband troubleshooting and master filter installs.
Starlink installer - one month free: https://www.starlink.com/?referral=RC-32845-88860-71
Wi-Fi and networking
Cel-Fi supply and installer - boost your mobile phone coverage legally

Need help in Auckland, Waikato or BoP? Click my email button, or email me direct: [my user name] at geekzonemail dot com

jnimmo

1098 posts

Uber Geek
+1 received by user: 255

#1230457 3-Feb-2015 13:03

Maybe an issue for some businesses, but could be a good thing for the high percentage of people out there who are currently connecting to POP accounts without using SSL :)

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

MadEngineer

4591 posts

Uber Geek
+1 received by user: 2570

Trusted

#1240486 16-Feb-2015 23:46

I'm curious to know what happens when you perform a remote device wipe from your exchange account when the app is using one device id across multiple devices as the article states.

You're not on Atlantis anymore, Duncan Idaho.

Zeon

3926 posts

Uber Geek
+1 received by user: 759

Trusted

#1240493 17-Feb-2015 00:31

jnimmo: Maybe an issue for some businesses, but could be a good thing for the high percentage of people out there who are currently connecting to POP accounts without using SSL :)

Haha so true. I can't believe people are still using POP these days considering the whole calendar/contact and real time email sync that activesync supports....

Speedtest 2019-10-14

Wade

2225 posts

Uber Geek
+1 received by user: 373

#1240505 17-Feb-2015 07:03

Our IT department blocked this app last week so am now using Gmail app as this is your only stock email option on Lollipop

MadEngineer: I'm curious to know what happens when you perform a remote device wipe from your exchange account when the app is using one device id across multiple devices as the article states.

At least on the Android app it doesn't require device manager rights to install so i guess it is not even an option to remote wipe device using Outlook app