I have an IMAP + SMTP server running on linux, using Dovecot + Postfix. The server only accepts connections over TLS and uses plaintext authentication once the tunnel is established.
I was auditing the mail logs today and was concerned by unknown remote IP addresses shown for some IMAP logins. After some investigation, I found that the logins correspond to Outlook for Android clients.
I am satisfied that the logins are legitimate since:
- no unauthorised mail has been sent
- there have not been any failed login attempts
- the behaviour has been consistent since the Outlook for Android clients were setup.
- the remote IP addresses seem to be registered to Microsoft.
The remote IPs are in the blocks:
52.125.138.x 52.125.140.x 52.125.141.x
The log entries look like:
dovecot: imap-login: Login: user=<...>, method=LOGIN, rip=52.125.x.x, lip=x.x.x.x, mpid=x, TLS, session=<...>
So I can only assume that the outlook mobile client is designed to use an intermediate server.
Presumably, this is to conserve battery life by allowing the MS server to poll the real mail server and push notifications to the phone.
However, as far as I can tell, this means Microsoft must be storing (at least temporarily) the user credentials in plain-text on their intermediate servers.
Is it possible that they could be authenticating over a TLS tunnel from their own server rather than the client device without sharing the credentials?
Does this mean that the intermediate server is able to read mail prior to pushing it to the client?
Is this behaviour documented or known?
p.s. others seem to have noticed this behaviour: