Active Directory Rights Management Services

Attacks against policy enforcement capabilities

In April 2016, researchers made public a method targeting Rights Management Services, including Azure RMS, and notified Microsoft. The technique lets an authorized user who can view an RMS-protected file strip away the protection while keeping the file's formatting intact. This action is possible only because the user already has permission to decrypt the content for viewing. Although RMS claims to block unauthorized access, the way it handles different usage rights among authorized users falls under what Microsoft calls "best effort" policy enforcement.

Microsoft therefore views this not as a security flaw but as a limitation of that enforcement. Earlier, the RMS SDK required code signing to restrict which apps could use RMS, but Microsoft later dropped that requirement because it did little to stop developers from writing applications that obtain decryption licenses directly through web services. Using the same approach, an authorized viewer can also alter a document's content without leaving any sign of the change.

Because Azure RMS does not offer non-repudiation or anti-tampering guarantees—unlike document signing tools—and because only users already granted access can make such changes, Microsoft does not consider this an attack on RMS's stated capabilities. The researchers shared a proof-of-concept tool on GitHub so others could test the findings.