Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Monday April 27 2020, @06:50PM   Printer-friendly
from the choosy-hackers-choose-gif dept.

Arthur T Knackerbracket has found the following story:

Microsoft has fixed a subdomain takeover vulnerability in its collaboration platform Microsoft Teams that could [have] allowed an inside attacker to weaponized a single GIF image and use it to pilfer data from targeted systems and take over all of an organization’s Teams accounts.

The attack simply involved tricking a victim into viewing a malicious GIF image for it to work, according to researchers at CyberArk who also created a proof-of-concept (PoC) of the attack.

Microsoft neutralized the threat last Monday, updating misconfigured DNS records, after researchers reported the vulnerability on March 23.“Even if an attacker doesn’t gather much information from a [compromised] Teams’ account, they could use the account to traverse throughout an organization (just like a worm),” wrote Omer Tsarfati, CyberArk cyber security researcher, in a technical breakdown of its discovery Monday. “Eventually, the attacker could access all the data from your organization Teams accounts – gathering confidential information, competitive data, secrets, passwords, private information, business plans, etc.”

The attack involves malicious actors being able to abuse a JSON Web Token (“authtoken”) and a second “skype token”. The combination of these two tokens are used by Microsoft to allow a Teams user to see images shared with them – or by them – across different Microsoft servers and services such as SharePoint and Outlook.

[...] “Now with both tokens, the access token (authtoken) and the Skype token, [an attacker] will be able to make APIs calls/actions through Teams API interfaces – letting you send messages, read messages, create groups, add new users or remove users from groups, change permissions in groups,” researchers wrote.

[...] Researchers [...] said Microsoft quickly deleted the misconfigured DNS records of the two subdomains, which mitigated the problem.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 1, Insightful) by Anonymous Coward on Tuesday April 28 2020, @12:16AM (1 child)

    by Anonymous Coward on Tuesday April 28 2020, @12:16AM (#987668)

    "Windows", you say? Security issue? Rather odd, never heard of security issues with Windows before, especially Microsoft Windows. What will they think of next?

    Starting Score:    0  points
    Moderation   +1  
       Insightful=1, Total=1
    Extra 'Insightful' Modifier   0  

    Total Score:   1  
  • (Score: 0) by Anonymous Coward on Tuesday April 28 2020, @12:41PM

    by Anonymous Coward on Tuesday April 28 2020, @12:41PM (#987798)

    Injecting disinfectants and scarring lung tissue with UV light.