Saint Bad Appointment, Who Robbed Without Being Let In

Patron of calendar invitations, reminder sounds, and credentials that leave on their own.

Life

On 14 March 2023 Microsoft fixed CVE-2023-23397 in Outlook, already used in targeted attacks reported by Ukraine's CERT. It was enough to send the victim an appointment whose reminder sound pointed to a network path the attacker controlled: Outlook connected to it by itself, before the message was even opened, handing over the NTLM credentials. An invitation that let itself in.

Prayer

O Saint Bad Appointment, who chimes while rifling through pockets, keep our calendars from talking to unknown networks. Amen.

How to celebrate

Celebrated by installing the March 2023 Outlook updates and blocking outbound NTLM to the internet.

An invite that rings itself opens the door itself.