Token-Mining Weakness in Microsoft Teams Makes for Perfect Phish

Access tokens for other Teams users can be recovered, allowing attackers to move from a single compromise to the ability to impersonate critical employees, but Microsoft isn't planning to patch.

4 Min Read
Remote collaboration opens door to vulnerabilities.
Source: Einur via Adobe Stock

Attackers who gain initial access to a victim's network now have another method of expanding their reach: using access tokens from other Microsoft Teams users to impersonate those employees and exploit their trust.

That's according to security firm Vectra, which stated in an advisory on Sept. 13 that Microsoft Teams stores authentication tokens unencrypted, allowing any user to access the secrets file without the need for special permissions. According to the firm, an attacker with local or remote system access can steal the credentials for any currently online users and impersonate them, even when they are offline, and impersonate the user through any associated feature, such as Skype, and bypass multifactor authentication (MFA).

The weakness gives attackers the ability to move through a company’s network much more easily, says Connor Peoples, security architect at Vectra, a San Jose, Calif.-based cybersecurity firm.

"This enables multiple forms of attacks including data tampering, spear-phishing, identity compromise, and could lead to business interruption with the right social engineering applied to the access," he says, noting that attackers can "tamper with legitimate communications within an organization by selectively destroying, exfiltrating, or engaging in targeted phishing attacks."

Vectra discovered the issue when the company's researchers examined Microsoft Teams on behalf of a client, looking for ways to delete users who are inactive, an action that Teams does not typically allow. Instead, the researchers found that a file that stored access tokens in cleartext, which gave them the ability to connect to Skype and Outlook through their APIs. Because Microsoft Teams brings together a variety of services — including those applications, SharePoint and others — that the software requires tokens to gain access, Vectra stated in the advisory.

With the tokens, an attacker can not only gain access to any service as a currently online user, but also bypass MFA because the existence of a valid token typically means the user has provided a second factor.

In the end, the attack does not require special permissions or advanced malware to grant attackers enough access to cause internal difficulties for a targeted company, the advisory stated.

"With enough compromised machines, attackers can orchestrate communications within an organization," the company stated in the advisory. "Assuming full control of critical seats — like a company’s head of engineering, CEO, or CFO — attackers can convince users to perform tasks damaging to the organization. How do you practice phish testing for this?"

Microsoft: No Patch Necessary

Microsoft acknowledged the issues but said the fact that the attacker needs to have already compromised a system on the target network reduced the threat posed, and opted not to patch.

"The technique described does not meet our bar for immediate servicing as it requires an attacker to first gain access to a target network," a Microsoft spokesperson said in a statement sent to Dark Reading. "We appreciate Vectra Protect's partnership in identifying and responsibly disclosing this issue and will consider addressing in a future product release."

In 2019, the Open Web Application Security Project (OWASP) released a top 10 list of API security issues. The current issue could be considered either Broken User Authentication or a Security Misconfiguration, the second and seventh ranked issues on the list.

"I view this vulnerability as another means for lateral movement primarily — essentially another avenue for a Mimikatz-type tool," says John Bambenek, principal threat hunter at Netenrich, a security operations and analytics service provider.

A key reason for the existence of the security weakness is that Microsoft Teams is based on the Electron application framework, which allows companies to create software based on JavaScript, HTML, and CSS. As the company moves away from that platform, it will be able to eliminate the vulnerability, Vectra's Peoples says.

"Microsoft is making a strong effort to move toward Progressive Web Apps, which would mitigate many of the concerns currently brought by Electron," he says. "Rather than rearchitect the Electron app, my assumption is they are devoting more resources into the future state."

Vectra recommends the companies use the browser-based version of Microsoft Teams, which has enough security controls to prevent exploitation of the issues. Customers who need to use the desktop application should "watch key application files for access by any processes other than the official Teams application," Vectra stated in the advisory.

About the Author(s)

Robert Lemos, Contributing Writer

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights