Microsoft Teams deemed unsafe to use by security researchers

INDONESIAKININEWS.COM -  Microsoft's workplace-oriented messaging app, Teams, has gone through a number of controversies that you wouldn...

INDONESIAKININEWS.COM - Microsoft's workplace-oriented messaging app, Teams, has gone through a number of controversies that you wouldn't expect other chat apps to deal with, including last year when the Android app was considered responsible for breaking the ability to place 911 calls on devices last year. 

Well, the Teams app — not the Android one this time, at least — is in the news again and it's not for the right reasons.

California-based cybersecurity research firm Vectra has uncovered a potentially serious flaw in the desktop version of the service wherein authentication tokens are stored in plain text, making them vulnerable to a third-party attack.

The issue affects the Teams app based on the company's Electron framework, which runs on Windows, macOS, and Linux machines. 

Vectra says that these credentials could theoretically be stolen by an attacker who has local or remote system access. Microsoft is aware of this vulnerability, although the company doesn't seem to be in a hurry to fix it.

Vectra elaborates that a hacker with the requisite access could steal data from an online Teams user and potentially mimic them when they're offline. 

This identity could then be used across apps like Outlook or Skype by circumventing the multifactor authentication (MFA) requirements. 

Vectra recommends users to stay away from the Microsoft Teams desktop app until a fix is available or, alternatively, use the Teams web app which has additional safeguards in place.

"Even more damaging, attackers can tamper with legitimate communications within an organization by selectively destroying, exfiltrating, or engaging in targeted phishing attacks," Connor Peoples, security architect at Vectra, said. He notes that this particular vulnerability only exists on the desktop version of Teams due to a lack of "additional security controls to protect cookie data."

To get its point across to Microsoft, Vectra even developed a proof-of-concept detailing the exploit, enabling the researchers to send a message to the account of the individual whose access token was compromised.

While the Electron platform makes it easy to build apps for desktops, it doesn't include crucial security measures like encryption or system-protected file locations, standard. Security researchers have constantly criticized this framework, although Microsoft doesn't consider it a serious issue yet.

Cybersecurity news site Dark Reading (via Engadget) approached the company for a comment on the Teams vulnerability and received a fairly lukewarm response, saying this security loophole "does not meet our bar for immediate servicing as it requires an attacker to first gain access to a target network." However, the company didn't rule out the possibility of a fix being rolled out in the future.

That said, if you're serious about your security, maybe it's best to leave the platform alone entirely for a while.

Source: androidpolice