Information security specialists have discovered a serious vulnerability in the Microsoft Teams desktop application: a bug allows access to authentication tokens, which, as it turns out, are stored in plain text format, without any protection.
Let me remind you that we also reported that SVCReady Malware Loader Uses Microsoft Office Documents for Attack. Researchers from the information security company Vectra talk about the problem. According to them, the vulnerability affects desktop versions of the application for Windows, Linux and macOS. In fact, an attacker with local access on a system where Microsoft Teams is installed could steal insecure tokens and then use them to sign into someone else’s account.
This attack does not require special permissions or complex malware, but can cause devastating damage.explains Vectra expert Connor Peoples.
During the review, it was determined that these tokens are active and are not a random dump of some previous error. These tokens gave us access to the Outlook and Skype APIs.the researchers say.
In fact, this method can be adopted by operators of infostealers, who will be able to use Microsoft Teams authentication tokens to bypass multi-factor authentication and gain full access to victims’ accounts. Since there will most likely not be a patch, Vectra recommends that users switch to the browser-based version of Microsoft Teams. They are also advising Linux users to switch to a different collaboration product, especially since Microsoft recently announced that it plans to end support for the platform by December.