Hacking Microsoft Teams vulnerabilities: A step-by-step guide

Introduction

We are living in an era where technology is part of our lives and a primary valuable resource for personal and professional tasks. The use of online videoconference platforms such as Zoom and Microsoft Teams has exploded in recent months, due in large part to the COVID-19 pandemic situation.

This article provides a detailed step-by-step guide on how to hack Microsoft Teams with a simple GIF image. The vulnerability published in April-mid 2020 could be exploited by a remote agent, and Microsoft promptly patched the flaw a few days after the disclosure. However, this scenario should be understood as an actual threat facing not only Microsoft Teams but all applications that maintain the same modus operandi.

How to hack Microsoft Teams

The disclosed flaw is a worm-like vulnerability that allows criminals to take over an organization’s entire roster of Teams accounts just by sending victims a malicious link to an innocent-looking GIF image.

Even if a criminal doesn’t have sensitive information from a Team’s account, the flaw can be used to perform a spread attack over the organization’s accounts just like a worm, getting the account’s tokens and then accessing all the chat sessions of the target users. Figure 1 below demonstrates how this attack can be executed against a large company.

Sponsorships Available

Sponsorships Available

Sponsorships Available

Figure 1: Microsoft Teams attack workflow

In detail, the attack can be exploited following the next steps:

1. A malicious GIF image is prepared and created by criminals and sent to a first victim during a videoconference via chat.
2. The victim opens and sees the message with the GIF image embedded. At this point, the criminal impersonates the victim and spreads the GIF image with the payload in the organization’s Teams accounts like a worm, infecting a large group of employees.
3. The message is disseminated and other (Read more...)