Microsoft Teams Vulnerability: A New Tool Auto-Delivers Malware

Cyberattack Tool “TeamsPhisher” Exploits Vulnerability in Microsoft Teams

A new cyberattack tool called “TeamsPhisher” has been discovered on GitHub that leverages a recently disclosed vulnerability in Microsoft Teams. The tool allows attackers to automatically deliver malicious files to targeted Teams users within an organization without relying on traditional phishing or social engineering scams.

Exploiting a Security Vulnerability in Microsoft Teams

The technique used by TeamsPhisher is based on a vulnerability uncovered by researchers at JUMPSEC Labs. While Microsoft Teams allows communications between users from different organizations, it restricts the sharing of files between them. However, the researchers found a way to bypass this restriction using the Insecure Direct Object Reference (IDOR) technique.

An IDOR bug allows an attacker to manipulate a “direct object reference,” such as a database key or query parameter, to interact maliciously with a web application. By switching the ID of the internal and external recipient when submitting a POST request, the researchers were able to host a payload on the sender’s SharePoint domain, which would then appear in the victim’s Teams inbox.

Microsoft acknowledged the vulnerability but determined that it did not require an immediate fix, a decision that may need reassessment given the release of TeamsPhisher.

The Functionality of TeamsPhisher

TeamsPhisher, developed by Alex Reid, a member of the US Navy’s Red Team, combines JUMPSEC’s technique with earlier research on leveraging Microsoft Teams by independent researcher Andrea Santese. It also incorporates techniques from TeamsEnum, a tool for enumerating Teams users.

The tool first enumerates a target Teams user and confirms their ability to receive external messages. It then creates a new thread with the target user, utilizing a technique that bypasses the usual “Someone outside your organization messaged you, are you sure you want to view it” message. The malicious message containing a link to the attachment on SharePoint is sent to the target user.

Once the initial message is sent, the sender can view and interact with the created thread in their Teams GUI. This allows for manual interaction with each victim, if necessary, on a case-by-case basis.

Microsoft‘s Response and Recommendations

At the time of reporting, Microsoft had yet to comment on the release of TeamsPhisher. Organizations that use Microsoft Teams are encouraged to review the necessity of enabling communications between internal Teams users and external tenants. If there is no legitimate business need for this communication, it is advised to tighten security controls and disable the functionality altogether.

Internet Security and the Ongoing Challenge

The emergence of tools like TeamsPhisher highlights the constant challenge faced by organizations to maintain internet security. As countless individuals and businesses rely on remote work and team collaboration tools, such as Microsoft Teams, to stay connected, hackers continuously adapt their methods to exploit vulnerabilities.

Software developers must remain vigilant in identifying and patching vulnerabilities, while users must stay informed and adopt best practices in cybersecurity. Regularly updating software, enabling multi-factor authentication, using strong and unique passwords, and being cautious of suspicious messages are just a few of the steps individuals and organizations can take to safeguard against cyberattacks.

Conclusion

The discovery of the TeamsPhisher tool and the exploitation of the vulnerability in Microsoft Teams underscore the need for constant vigilance in the realm of internet security. As technology evolves, so do the methods employed by malicious actors, reminding users and developers alike of the importance of staying informed, implementing necessary security measures, and prioritizing cybersecurity at all levels.

Only through a collaborative effort that combines timely patching, user education, and a commitment to proactive security measures can we hope to stay ahead of those seeking to exploit vulnerabilities and protect our digital landscapes.