Can Logout Failure Compromise Email Account? Risk assessment

Question

I get constant reports of failure to sign-out from my Outlook account. I am wondering if this problem can compromise the account or generate a vulnerability (backdoor-path)?

Inability to log out means that user leaves an open-session to the account, and if attacker grabs a cookie (by syncing browser history) he can easily re-enter the account and hijack the associated session.

Closing the browser may partially help to prevent this type of attack. But, closing browser invalidates cookie only on user-end, not on server-end (email provider), which may still be Active. Also, 2FA is completely useless at this point, because the "entry" to the account already been authenticated by the user upon successful login (with, or without 2FA).

So, how do I know if a session to the account has expired if I can't logout from it? Could a failure to logout be a sign that someone else accessing my account?

Answer 1

So, how do I know if a session to the account has expired if I can't logout from it?

If you can still access resources which require your authorization then you are not logged out. Thus simply try to access new mails or similar in case of Outlook web interface.

Could a failure to logout be a sign that someone else accessing my account?

Probably not. But details depend on the specific application and its current state of implementation which can vary from day to day.

Answer 2

I get constant reports of failure to sign-out from my Outlook account. I am wondering if this problem can compromise the account or generate a vulnerability (backdoor-path)?

There are many issues with Microsoft authentication - especially with their cloud services (which I assume you are accessing Outlook via web). Technically speaking, if someone were to obtain the client auth token at any point in time (initial sign-in, current use, or upon signing-out) it would compromise the account. However, this would only be possible after another, more concerning vulnerability was exploited in order for an attacker to be in that power position. This compromise could also generate new exploits and create persistence simply by sending his/her account a malicious email and you opening it for them since you have control of their account.

So, how do I know if a session to the account has expired if I can't logout from it?

I agree with Steffen on this one. If you really need proof for the assessment, I guess you could monitor the packet traffic.

Could a failure to logout be a sign that someone else accessing my account?

I agree with Steffen on this as well.