Microsoft patches Teams against image-based account takeover flaw

Malicious gifs that produced cookies could be used to access an entire organisation's accounts

Microsoft has moved fast to patch a vulnerability that let hackers take over Teams accounts simply by sharing malicious gifs. 

The issue could have potentially affected every user that uses Microsoft Teams on desktop or in a web browser, according to CyberArk, which worked with the tech giant's security research centre. 

The hack is essentially a subdomain takeover whereby attackers use a gif to scrape user data and gain control of an entire organisations' Teams accounts as it's shared through the service. 

This is an exploit of the way Teams passes authentication access tokens to image resources. Every time a user opens the app a temporary token is created in the form of a JESON Web Token (JWT). These allow other users to see images shared with them or by them, as they are stored on a Microsoft server. A user only has to see the image for the attack to start spreading automatically. 

This creates two cookies that allow hackers to make calls through the Teams APIs as well as have complete control over an account. This includes being able to read and send messages, create groups, add or remove participants and change permissions.

The only hurdle to the attack is that "authtoken" can only be used with a subdomain.

"If an attacker can somehow force a user to visit the sub-domains that have been taken over, the victim's browser will send this cookie to the attacker's server, and the attacker (after receiving the authtoken) can create a skype token," CyberArk explained in a blog post. "After doing all of this, the attacker can steal the victim's Teams account data" 

Microsoft has patched the issue after being alerted to the threat via its vulnerability disclosure program. The tech giant deleted misconfigured DNS records that allowed the attackers to gain control of the subdomains. 

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Recommended

Alkira offers Check Point CloudGuard Security to secure virtual cloud networks
Cloud

Alkira offers Check Point CloudGuard Security to secure virtual cloud networks

29 Sep 2021
Iboss protects web sessions with remote browser isolation
Cloud

Iboss protects web sessions with remote browser isolation

16 Aug 2021
Most CISOs worry cloud software flaws aren’t being caught
cloud security

Most CISOs worry cloud software flaws aren’t being caught

7 Jun 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Windows 11 has problems with Oracle VirtualBox
Microsoft Windows

Windows 11 has problems with Oracle VirtualBox

5 Oct 2021
What is cyber warfare?
Security

What is cyber warfare?

15 Oct 2021