Microsoft Enhances Security for OneNote Users by Blocking Dangerous File Extensions

Microsoft has announced an update to its popular note-taking application, OneNote, to improve security measures for users by automatically blocking embedded files with extensions that are considered dangerous. The change comes as a response to an increase in malicious campaigns exploiting OneNote’s ability to attach files that could be executed with limited warnings to users.

OneNote, which is part of the Microsoft Office suite, is commonly used by enterprise users for note taking, task management, and multi-user collaboration. Historically, users were notified that opening a OneNote attachment could be harmful, but they were given the option to dismiss the warning and proceed with opening the embedded file. This made OneNote a target for malware delivery by threat actors.

The issue became more pressing after security researchers warned last year that the Mark-of-the-Web (MOTW) protection was not being applied to OneNote documents and their attachments. Consequently, the abuse of OneNote in malicious campaigns surged.

Microsoft’s new security feature aims to make it more difficult for attackers to exploit OneNote for malware delivery. With the update, users will no longer be able to directly open embedded files with dangerous extensions. Instead, they will need to save the file to their device and open it from there, giving security applications running on the device an opportunity to detect any malicious code in the attachment.

The list of blocked extensions is consistent with those blocked by other Office applications, including Word, Excel, Outlook, and PowerPoint. However, Microsoft 365 administrators have the ability to set policies to block additional file types or to allow specific file types to be opened.

The change will only impact OneNote for Microsoft 365 on devices running Windows and is expected to roll out starting in April 2023, becpming visible to all users by January 2024. OneNote in retail versions of Office 2021, Office 2019, and Office 2016 will also be affected.

Microsoft has cautioned users about the risks of allowing certain file extensions, stating, “Malicious scripts and executables can cause harm if clicked by the user. If extensions are added to this allow list, they can make OneNote and other applications, such as Word and Excel, less secure.”

As Microsoft continues to prioritize user safety, this update provides an added layer of protection against cyber threats for OneNote users.

File types blocked in Word, Excel, Outlook, PowerPoint, and OneNote

References

Microsoft Learn. (2023, March 29). OneNote blocks embedded files that have dangerous extensions – Deploy Office | Microsoft Learn. https://learn.microsoft.com/en-us/deployoffice/security/onenote-extension-block

SecurityWeek. (2023, April 3). Microsoft OneNote Starts Blocking Dangerous File Extensions – SecurityWeek. https://www.securityweek.com/microsoft-onenote-starts-blocking-dangerous-file-extensions/