Microsoft was caught scanning password-protected zip files stored on SharePoint Online

Microsoft has found itself in hot water after it was discovered that the company was scanning password-protected zip files stored on SharePoint Online for malware. Security researcher Andrew Brandt, who uses Microsoft’s cloud services to save copies of malware in password-protected zip files, was surprised to find that Microsoft had flagged some of his files as malware after they had been uploaded into a SharePoint directory. While Microsoft has good reasons to scan files stored on its cloud services for malware, doing so on password-protected files may go a step too far for some customers.

For security researchers, using cloud services to back up and share malware in protected files is a pretty common practice. Brandt also said in a Mastodon thread that he started to keep malware in passworded zips last year after the OneDrive app on his work laptop decided to back up his files, then deleted them from both his hard drive and the cloud after they had been flagged as malware. However, the recent discovery that Microsoft is scanning password-protected files has caused some concern among security researchers.

“The available space to do this just keeps shrinking and it will impact the ability of malware researchers to do their jobs,” Brandt said. Kevin Beaumont, another security researcher and former Microsoft employee, explained how Microsoft manages to see what’s inside password-protected files on its cloud services. According to Beaumont, Microsoft “has a password list it runs through files,” and Brandt used the easy-to-guess “infected” password on his protected zip files. Beaumont added that Microsoft also extracts passwords from email bodies.

While Microsoft’s scanning for malware on its cloud services is understandable, some customers may be concerned about the company’s scanning of password-protected files. As the amount of available space for malware researchers to do their jobs continues to shrink, it remains to be seen how Microsoft will address this issue.