Microsoft won’t say why its free Office website in South Africa has been down for 3 months
Microsoft South Africa has kept mum on the reasons why the website for its free Office programme in South Africa has remained down for more than three months.
The Mahala by Microsoft programme provides any South African between 8 and 24 with a free licence to six apps from its widely-used productivity suite, including Word, Excel, and PowerPoint.
It also comes with 5GB OneDrive cloud storage, putting the total value of the package at R1,800.
Microsoft launched the programme in a partnership with Penguin Lava Lamp Lab and NBConsult to enable learners from grades R to 12 to become more productive in preparation for their future academic endeavours and professional careers.
By the time the service was taken offline in September to address a security vulnerability, more than 22,000 users had signed up for the offer.
That followed MyBroadband informing Microsoft that a security flaw allowed anybody with access to the platform to get the personal data of all the users, including their name, email address, and phone number.
The vulnerability was pointed out to us by concerned MyBroadband reader Israel Ndou, who feared it might be used by malicious actors who sell the information or use it in phishing attacks.
He revealed that using a simple command through Powershell with a module that can be connected Microsoft’s cloud-based identity and access management service, Azure Active Directory (AD), any Mahala user could download the user names, email addresses, mobile phone numbers, and Mahala.ms email addresses of all the other users.
Ndou provided the command that could be used to download a CSV file to allow MyBroadband to report the issue to Microsoft.
We also found that instructions for these types of Powershell commands for Azure AD were readily available on the Internet.
While existing Mahala users are still able to use the included apps, the account functionality is offline, which means they would be unable to use it if they had logged out or wanted to use the service on a new device.
The image below is what visitors to the Mahala.ms portal have been greeted with since early September.
When asked for an update, Microsoft provided the same response it had already sent to MyBroadband twice regarding the data exposure.
Microsoft said it took privacy seriously, that the issue was “not a security vulnerability”, and that it had been addressed.
“The Mahala service is operational for existing users and we are working to resume the service for new subscribers,” it added.
However, there were no further explanations on why the process was taking so long, nor a timeframe on when it would be available again.
Several educators complained that the inability to sign up for the offer had been a major obstacle in their students’ preparations for final exams.
This unavailability of the Mahala platform, combined with the cost of the standard Microsoft 365 subscription, could push students towards an alternative avenue— piracy—to which Microsoft is no stranger.
The software giant recently introduced a programme in India and the US offering users of unlicensed software a big discount on its Microsoft 365 plans.
However, the programme does not appear to include South Africa, which means users have to pay R109 per month or R1,099 per year for an entry-level home-use subscription for a single user.
Loading ...