Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/27/2020
04:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Microsoft Patches Dangerous Teams Vulnerability

CyberArk says issue would have allowed attackers to take over Teams accounts using a malicious GIF.

Microsoft has patched a dangerous vulnerability in its Teams collaboration platform that would have allowed attackers to potentially take control of an organization's entire roster of Teams accounts using a malicious GIF.

The vulnerability is the latest to highlight the heightened risks that organizations face from having a high percentage of their employees work from home because of the COVID-19 pandemic.

Researchers from CyberArk discovered the vulnerability while examining Microsoft Teams' security this March. According to the security vendor, the problem had to do with how authentication information was handled when users shared or viewed images that were shared with them on the Teams platform.

The process gave attackers an opening to share seemingly harmless GIF images on Teams that would result in a user's authentication information getting snagged and misused in order for them to take control of the user's Teams account.

Omer Tsarfati, a cybersecurity researcher at CyberArk, says the vulnerability actually is based on a chain of things happening. The first is the fact that every time a user launches Teams, the platform establishes a cookie called "authtoken." The cookie contains an access token that ordinarily should be sent to the organization's teams-dot-Microsoft-dot-com domain or subdomains under it.

During the research, CyberArk researchers discovered two subdomains under teams-dot-Microsoft-dot-com that were susceptible to subdomain takeover – a situation where an attacker could impersonate the subdomains for malicious purposes.

The researchers found that if an attacker could impersonate the subdomains and somehow lead a user to click on a link leading to the subdomains, the victim's "authtoken" would be sent to them. This would allow the attacker to grab the "authtoken" and use it to create another token called "skypetoken." The attacker would then have been able to use the two tokens together to access the victim's Teams data.

"An attacker could simply send a malicious GIF image to a target user – which will provide the attacker with the user's Teams token," Tsarfati says.

What's particularly interesting about this flaw is that the user just needs to see the incoming GIF to become a victim, he says. "After stealing the Teams identity of the first victim, the attacker could impersonate him or her and send malicious GIFs to more employees and groups until a company's entire Teams environment is compromised," Tsarfati says.

In a worst-case scenario, an attacker would have been able to steal all past messages, view calendars, send and join Team meetings, and carry on other activities under the guise of a legitimate user. The vulnerability gave attackers an opening to impersonate employees and ask for sensitive information, such as reports and password resets, Tsarfati says.

Increased Exposure
In recent weeks, businesses have dramatically increased their use of collaboration platforms, such as Teams, Zoom, and Slack, to support employees forced to work from home because of COVID-19 social-distancing mandates. In many cases, IT organizations have been forced to support a massive increase in the use of these platforms without having an opportunity to fully vet them for security issues or to implement risk mitigation measures.

"In a time where so many organizations are relying on communication and collaboration technologies to stay connected to one another, it can be easy to not always stay vigilant when it comes to security," Tsarfati notes.

Employees should be suspicious of any irregular messages and GIFs they get from users – especially if they don't recognize or don't regularly speak to that person, he says. "Also, don't share sensitive information – like passwords – on Teams or any collaboration tool for that matter," Tsarfati adds. "You never know who may be listening."

According to CyberArk, Microsoft fixed the subdomain takeover issue within one day of being notified of the problem. It addressed the security issue related to the GIFs on April 20.

Tim Mackey, principal security strategist at Synopsys CyRC, says CyberArk's research shows how complex systems like the Teams platform can provide opportunities for attack.

In this particular case, attackers would have had a relatively hard time exploiting the vulnerability, he says. "In the case of Teams, there's the ability to host content on the Teams site that is customer-specific," Mackey says. "If an attacker is going to create a dummy site hanging off of the customer Teams site, they would also need to apply an SSL certificate."

This could get tricky because the attacker would need to engage a reputable cert authority to issue the certificate for the fake site.

"In the PoC video that CyberArk issued shows us, the threat is considerable to enterprise organizations," Mackey says. "As a target, you don't have to do anything more than open a chat with a malicious GIF for the attack to be carried out."

Related Content:

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "5 Ways to Prove Security's Worth in the Age of COVID-19."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/17/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5421
PUBLISHED: 2020-09-19
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
CVE-2020-8225
PUBLISHED: 2020-09-18
A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials.
CVE-2020-8237
PUBLISHED: 2020-09-18
Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
CVE-2020-8245
PUBLISHED: 2020-09-18
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11....
CVE-2020-8246
PUBLISHED: 2020-09-18
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-W...