Microsoft has just taken a vital step towards better protecting your devices from malware, and it’s one that could stop viruses dead in their tracks. Interestingly, though, the Redmond giant seems to have made no mention of the change, despite its significance.
The new policy might sound minor on the surface: Microsoft’s SharePoint cloud storage service can apparently now scan files that are encrypted or password-protected. Previously, this wasn’t thought to be possible.
The importance of this move lies in the nefarious tactics of hackers and malware writers. The fact that antivirus apps have struggled to read password-protected files for so long has made them an attractive method of attack. Now that SharePoint can penetrate into their murky depths, you should have a much better idea of whether the file you uploaded can be trusted.
The change was noticed by Andrew Brandt, Principal Researcher at cybersecurity firm Sophos. Brandt stumbled upon the new policy after it affected their own SharePoint directory, which contained an archive of malware strains stored in password-protected zip files.
Unfortunately for Brandt, the update was not entirely welcome. As they explained on their Mastodon page, “a couple of password-protected Zips are flagged as “Malware detected” which limits what I can do with those files — they are basically dead space now.”
“While I totally understand doing this for anyone other than a malware analyst,” Brandt continued, “this kind of nosy, get-inside-your-business way of handling this is going to become a big problem for people like me who need to send their colleagues malware samples.”
While that is undoubtedly a frustrating development for malware researchers using SharePoint in this manner, it is surely a good thing for everyday users who might upload infected files without knowing the contents of the encrypted files.
A quiet change
Brandt sheds some light on what SharePoint will do with password-protected files that it deems to be malicious, although it’s not immediately clear from their message how user actions are limited by Microsoft.
However, a Microsoft support page explains that its Safe Attachments feature will scan files in SharePoint, OneDrive, and Teams. Files determined to be malware are “locked,” which means “people can’t open, copy, move, or share” them. You can still view and delete the files, though.
Yet the support page doesn’t mention encrypted or password-protected files, and Microsoft has made no announcement of the policy change on its security blog. That’s a touch surprising given how important the new stance could be.
Still, it’s good to see Microsoft take action on password-protected files that have long eluded close inspection due to their locked-up nature. Although it might be an inconvenience to security researchers, it is no doubt a boon for everyday users. Hopefully, Microsoft can quickly find a solution that doesn’t impede researchers’ work.
