Connection Strings

Feature or Flaw? Microsoft Outlook's View Code Might Be Hackable

Sensepost says it has discovered a method for hackers to compromise Microsoft Outlook by way of a Visual Basic-embedded shell. The catch: It requires a feat of social engineering to pull it off.

While the nefarious WannaCry ransomware and DocuSign breach are top-of-mind security issues since they affect so many, there's also this sneaky hack that might have some Outlook developers worried. Security firm Sensepost says it has discovered a method by which a feature of Microsoft Outlook can be used by hackers to run whatever software or apps they want. That discovery was published in this article by Rene Millman on the SC Media UK news site, which links to this Sensepost blog post.

In a nutshell, Millman's piece explains that security researchers at Sensepost discovered what appears to be a hole in an Outlook Forms feature called "View Code – Edit the Visual Basic code for a control" that allows a Visual Basic shell to be embedded from a newly created form. When the form is enabled, it activates the shell, which then can allow a hacker to take over a user's machine. The researchers discovered that the form could still run even with macros disabled in Outlook, since it didn't use the macro script engine but its own VBscript engine.

Millman notes in his article that Microsoft did respond to the hackability claim, essentially saying that Sensepost is misguided to characterize that Outlook feature as vulnerability -- the steps required to execute a hack would require quite a feat of social engineering to compromise passwords and disable security along the way to the end result. Millman's piece is an interesting read, especially as it has responses from independent security researchers on their opinions of this Outlook feature/flaw.

Here are a handful of other more links we've run across that might be useful to you, in no particular order and definitely not conforming to any particular theme:

Andrzej's C++ blog: A serious bug in GCC Windows Template Studio Resource Roundup

John Papa: VS Code Function Keys in the MacBook Touchbar

Mono Project: Mono 5.0.0 Release Notes

Scott Hanselman: BUILD 2017 Conference Rollup for .NET Developers

Wu Shuai's Blog: Docker Compose ASP.NET Core to Nano Image with Windows Container Serverless C# with Azure Functions: HTTP-Triggered Functions Microsoft's Cloud Growth Putting Pressure on Amazon Xamarin Live Player Eases iOS Development from Windows (But You'll Still Need a Mac) Microsoft Advises Developers To Stop Using Azure Active Directory Graph

Know of an interesting link, or does your company have a new or updated product or service targeted at Visual Studio developers? Tell me about it at

About the Author

Michael Domingo is a long-time software publishing veteran, having started up and managed several developer publications for the Clipper compiler, Microsoft Access, and Visual Basic. He's also managed IT pubs for 1105 Media, including Microsoft Certified Professional Magazine and Virtualization Review before landing his current gig as Visual Studio Magazine Editor in Chief. Besides his publishing life, he's a professional photographer, whose work can be found by Googling domingophoto.

comments powered by Disqus


  • What's New in Visual Studio 2019 v16.5 Preview 2

    The second preview of Visual Studio 2019 v16.5 has arrived with improvements across the flagship IDE, including the core experience and different development areas such as C++, Python, web, mobile and so on.

  • C# Shows Strong in Tech Skills Reports

    Microsoft's C# programming language continues to show strong in tech industry skills reports, with the most recent examples coming from a skills testing company and a training company.

  • Color Shards

    Sharing Data and Splitting Components in Blazor

    ASP.NET Core Version 3.1 has at least two major changes that you'll want to take advantage of. Well, Peter thinks you will. Depending on your background, your response to one of them may be a resounding “meh.”

  • Architecture Small Graphic

    Microsoft Ships Preview SDK, Guidance for New Dual-Screen Mobile Era

    Microsoft announced a new SDK and developer guidance for dealing with the new dual-screen mobile era, ushered in by the advent of ultra-portable devices such as the Surface Duo.

  • How to Create a Machine Learning Decision Tree Classifier Using C#

    After earlier explaining how to compute disorder and split data in his exploration of machine learning decision tree classifiers, resident data scientist Dr. James McCaffrey of Microsoft Research now shows how to use the splitting and disorder code to create a working decision tree classifier.

.NET Insight

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.

Upcoming Events