Microsoft Teams deemed unsafe to use by security researchers

INDONESIAKININEWS.COM -  Microsoft's workplace-oriented messaging app, Teams, has gone through a number of controversies that you wouldn...

 Microsoft's workplace-oriented messaging app, Teams, has gone through a number of controversies that you wouldn't expect other chat apps to deal with, including last year when the Android app was considered responsible for breaking the ability to place 911 calls on devices last year. 

Well, the Teams app — not the Android one this time, at least — is in the news again and it's not for the right reasons.

California-based cybersecurity research firm Vectra has uncovered a potentially serious flaw in the desktop version of the service wherein authentication tokens are stored in plain text, making them vulnerable to a third-party attack.

The issue affects the Teams app based on the company's Electron framework, which runs on Windows, macOS, and Linux machines. 

Vectra says that these credentials could theoretically be stolen by an attacker who has local or remote system access. Microsoft is aware of this vulnerability, although the company doesn't seem to be in a hurry to fix it.

Vectra elaborates that a hacker with the requisite access could steal data from an online Teams user and potentially mimic them when they're offline. 

This identity could then be used across apps like Outlook or Skype by circumventing the multifactor authentication (MFA) requirements. 

Vectra recommends users to stay away from the Microsoft Teams desktop app until a fix is available or, alternatively, use the Teams web app which has additional safeguards in place.

"Even more damaging, attackers can tamper with legitimate communications within an organization by selectively destroying, exfiltrating, or engaging in targeted phishing attacks," Connor Peoples, security architect at Vectra, said. He notes that this particular vulnerability only exists on the desktop version of Teams due to a lack of "additional security controls to protect cookie data."

To get its point across to Microsoft, Vectra even developed a proof-of-concept detailing the exploit, enabling the researchers to send a message to the account of the individual whose access token was compromised.

While the Electron platform makes it easy to build apps for desktops, it doesn't include crucial security measures like encryption or system-protected file locations, standard. Security researchers have constantly criticized this framework, although Microsoft doesn't consider it a serious issue yet.

Cybersecurity news site Dark Reading (via Engadget) approached the company for a comment on the Teams vulnerability and received a fairly lukewarm response, saying this security loophole "does not meet our bar for immediate servicing as it requires an attacker to first gain access to a target network." However, the company didn't rule out the possibility of a fix being rolled out in the future.

That said, if you're serious about your security, maybe it's best to leave the platform alone entirely for a while.

Source: androidpolice


Baerita,2,Berita,23964,Cek Fakta,3,H,151,HUMOR,7,Internasional,1000,Kesehatan,29,Nasional,23000,News,1361,OPINI,81,Politik,6,Seleb,3,Tekno,1,Viral,3,
IndonesiaKiniNews.com: Microsoft Teams deemed unsafe to use by security researchers
Microsoft Teams deemed unsafe to use by security researchers
Loaded All Posts Not found any posts VIEW ALL Selengkapnya Balas Cancel reply Hapus Oleh Beranda Halaman Postingan View All RECOMMENDED FOR YOU LABEL ARCHIVE CARI ALL POSTS Not found any post match with your request KEMBALI KE BERANDA Minggu Senin Selasa Rabu Kamis Jum'at Sabtu Sun Mon Tue Wed Thu Fri Sat January February March April May June July August September October November December Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec just now 1 minute ago $$1$$ minutes ago 1 hour ago $$1$$ hours ago Yesterday $$1$$ days ago $$1$$ weeks ago more than 5 weeks ago Followers Follow THIS CONTENT IS PREMIUM Please share to unlock Copy All Code Select All Code All codes were copied to your clipboard Can not copy the codes / texts, please press [CTRL]+[C] (or CMD+C with Mac) to copy