Links embedded in emails are not being properly scanned for malicious content, and a client is mad with it

Nov 25, 2015 23:02 GMT  ·  By

Microsoft has apparently admitted to a problem that resides in its Office 365 Advanced Threat Protection (ATP) module, according to security news site SC Magazine.

Office 365 is made of a set of subscription-based software packages that address various operations and services needed inside a business' offices. To cut down the enterprise mumbo-jumbo, it's Microsoft's classic Office suite running in the cloud, but with some extra cool toys, for which you have to pay.

The problem lies in the email link scanning feature

One of Office 365's modules is called Advanced Threat Protection, and it helps businesses protect their email service. This is done in two ways. The first is via ATP's Safe Attachments service that scans email attachments for malicious content, and the second is ATP's Safe Links feature, which safeguards users from clicking on dangerous links.

ATP's Safe Links feature works by scanning emails for links, having Microsoft access the link and search for potentially dangerous content. Whenever the user opens the email and tries to click on a malicious link, Microsoft, having already examined the link, will warn them about the dangers of their action.

According to SC Magazine, there's a problem with the Safe Links feature for the Office 365 ATP module. The news outlet is quoting Nick Ioannou, head of IT at the RG Partnership Ltd and Microsoft customer, who is saying that he filed a bug with the Redmond-company back in September, but the company has failed to fix it.

Microsoft was made aware of the issue, hasn't provided a fix or patch timeline

Mr. Ioannou goes on to add that the Safe Links feature is not working at all and is not scanning any links. Since Microsoft is charging for this service and hasn't bothered providing an ETA for when it will get fixed, you can understand its customer may be annoyed.

Mr. Ioannou is also saying that Microsoft acknowledged the problem and that the company also recognized that a complete rewrite of the ATP Safe Links feature was needed.

"It should be in beta," says Ioannou, "it should never have been released and charged for."

Softpedia has contacted Microsoft, but we don't expect to have an official answer until next week since we got the generic "Out of office for Thanksgiving" automated message. We'll update the article with new information as soon as we have it.

UPDATE: A Microsoft PR spokesperson said the company does not want to comment on this incident.