The Outlook bug that needs no click

Last Tuesday’s patches fixed CVE-2023-23397, and it’s a nasty one. An attacker sends an email or meeting invite with a reminder whose sound file points to their own server. When Outlook processes the reminder, Windows tries to log in to that server and hands over the user’s NTLM hash. No click needed.

Microsoft says it has been used in targeted attacks for months.

What to do:

1. Install the March update for Outlook for Windows. Other Outlook versions and Outlook on the web aren’t affected.
2. Block outbound TCP 445 (SMB) from your network to the internet. There’s almost never a reason to allow it.
3. Put admins and sensitive users in the Protected Users group, which stops NTLM for them.
4. Run Microsoft’s script to look for messages with this kind of reminder in your mailboxes.

And if you can, plan to reduce NTLM in general. It keeps showing up in attacks like this.