It’s come to light that Microsoft, the tech giant, is actively looking for harmful software, commonly known as malware, in zip files with password protection. These files are stored within Microsoft’s own cloud services.
The discovery was made by several individuals, one of whom was Andrew Brandt, a researcher focused on security. Brandt and others have observed that Microsoft seems to be getting around the passwords on zip files. They do this to perform their malware checks.
While it’s clear that Microsoft’s aim might be to protect users from potential threats, this action has raised many eyebrows. It’s led to a flurry of questions about the safety and privacy of user data. When a company can bypass password protections to scan for threats, it leaves us wondering how private and secure our information truly is.
Andrew Brandt posted on the Infosec Exchange:
Well, apparently #microsoft #Sharepoint now has the ability to scan inside of password-protected zip archives.
How do I know? Because I have a lot of Zips (encrypted with a password) that contain malware, and my typical method of sharing those is to upload those passworded Zips into a Sharepoint directory.
In addition to Andrew Brandt, another security expert, Kevin Beaumont, shed some light on Microsoft’s practices. Beaumont highlighted that Microsoft doesn’t just use one method but several different techniques to inspect the contents of password-protected files. This extends across the entirety of Microsoft’s 365 cloud services. Even if you’re using OneDrive, Microsoft’s popular cloud storage service, your files aren’t exempt from this thorough inspection.
The extent of Microsoft’s scanning practices has brought even more attention to the ongoing discussion about data privacy and security.
