Beware of the GIF: Account Takeover Vulnerability in Microsoft Teams

https://www.cyberark.com/threat-research-blog/beware-of-the-gif-account-takeover-vulnerability-in-microsoft-teams/

by jrenshaw • 6 years ago

166 67 6 years ago

cyberark.com

abluecloud• 6 years ago

I'm confused as to how they do the sub domain takeover.

zaroth• 6 years ago

Came here to ask the exact same question.

TLDR; Authorization cookie for an important Account API is sent to *.teams.microsoft.com and they got control of a subdomain of that somehow.

cotillion• 6 years ago

Those records probably pointed to an ip or a CNAME which was not registered or not under microsoft control. But some more information on that mistake would have been nice.

munchbunny2• 6 years ago

I had to read up on it, the gist of it is (these are example domain names I made up for illustration):

1. Domain like "abcde.teams.microsoft.com" has a CNAME that points to a domain like "abcde.microsoft-teams.com", but "microsoft-teams.com" is no longer registered to or controlled by Microsoft.

2. Hacker registers microsoft-teams.com, gets a LetsEncrypt SSL for it.

3. Send a message to someone with a GIF that was uploaded to "abcde.teams.microsoft.com". Teams thinks it's legit because it's a subdomain of "teams.microsoft.com", and SSL checks out, so it sends the user's auth token along with the HTTP request for the GIF. Problem is, it's sending it to the attacker controlled "abcde.microsoft-teams.com".

4. Since the hacker controls "abcde.microsoft-teams.com", they now have your auth token, which they can use to impersonate you.

Et voila, account takeover.

I'd bet that plenty of whitehats and blackhats have bots automatically crawling domains belonging to tech companies searching for subdomain takeover opportunities.

tidepod12• 6 years ago

Domain like "abcde.teams.microsoft.com" has a CNAME that points to a domain like "abcde.microsoft-teams.com", but "microsoft-teams.com" is no longer registered to or controlled by Microsoft.

Can you elaborate a bit on this? I get that these are example domains, but why would "abcde.teams.microsoft.com" (which is presumably controlled by Microsoft) point to a domain "microsoft-teams.com" that is not controlled by Microsoft? Was that a mistake on Microsoft's part, or did the attackers do something clever to gain control of that domain/point a Microsoft-owned subdomain to the attacker's domain?

staticvar• 6 years ago

Aha! Thank you munchbunny. Another title for this article could be "How some major tech companies DNS record management practices left your organization vulnerable to attack". This is a great lesson for all of us. Leaving old records in DNS is so easy to do.

donmcronald• 6 years ago

I don't think you got it quite right. No one would ever see microsoft-teams.com and you wouldn't need an SSL cert for it. The CNAME affects the DNS lookup, so if you ask "where's abcde.teams.microsoft.com", the server replies "it's at the same IP as "microsoft-teams.com, so go look there".

Since you control the DNS for microsoft-teams.com, you can point it to your server. Now both domains point at your server and you get all requests to abcde.teams.microsoft.com. That's how they get cookies.

You can get an SSL certificate because you can serve anything for abcde.teams.microsoft.com. That includes abcde.teams.microsoft.com/.well-known/acme-challenge/* and the .gif (or other) resource you use to steal cookies.

Either abcde.microsoft-teams.com is a typo or you seem to think CNAMEs work like an HTTP redirect, which they don't.

aaron_m04• 6 years ago

I'd bet that plenty of whitehats and blackhats have bots automatically crawling domains belonging to tech companies searching for subdomain takeover opportunities.

If Microsoft had one of these, they could've caught this before it was exploited.

ThePowerOfFuet• 6 years ago

Shame they totally skipped the whole sub domain takeover bit, which was required for the exploit to work.

hundchenkatze2• 6 years ago

I guess a DNS configuration issue doesn't drive as many clicks.

lonelappde4• 6 years ago

General info: https://www.hackerone.com/blog/Guide-Subdomain-Takeovers

eugenekolo• 6 years ago

Weird lead in about GIFs to simply saying they had a subdomain takeover.

lonelappde4• 6 years ago

Clickbait.

A4ET8a8uTh0• 6 years ago

I was always confused by seeing those types of exploits. In my head, I could not see why would GIF cause anything other show up on screen. But then I remember I think of offline activity.

All that said, and please excuse my ignorance here, but how common is it for subdomain not to be under the control of its owner?

msla• 6 years ago

All that said, and please excuse my ignorance here, but how common is it for subdomain not to be under the control of its owner?

This is how FreeDNS works: There's lots of domains which are donated to the project, and people can register subdomains of those domains and have them point to their own systems, with software to ensure the DNS records stay up-to-date even in the face of dynamic IP addresses.

https://freedns.afraid.org/faq/

floatingatoll• 6 years ago

2018: You CNAME subdomain.microsoft.com. to blahblahblah.heroku.com.

2019: You replace blahblahblah and shut it down on Heroku

2020: An attacker creates blahblahblah.heroku.com. and can now read and write cookies for *.microsoft.com.

Replace Heroku with any off-domain hosting service that lets you register a vanity or predictable hostname rather than assigning a GUID.

thyrsus• 6 years ago

This is why one should not automatically load external content in e-mails. This Forbes article covers the same territory: https://www.forbes.com/sites/thomasbrewster/2020/04/27/your-...

I have to say, these headlines immediately made me think of this long ago fixed bug: https://www.cvedetails.com/cve/CVE-2008-2160/

lonelappde4• 6 years ago

That's not what this bug is about. The bug is not to do with the content, but merely the connection. And it's only "external" because Microsoft relinquished control of its internal system but still treated it as internal.

egfx2• 6 years ago

Wasn’t WhatsApp also compromised via gif? Gif is a really remarkable format that seems so simple but it’s much more. It’s just a series of images with timings but then you realize that the first few bits of the gif can be written with arbitrary code.

A somewhat deep dive into the format https://enthusiasms.org/post/16976438906

stri8ed• 6 years ago

This attack does not depend on the GIF. It could just as well have been a JPEG.

hundchenkatze2• 6 years ago

Except in this case it didn't really have anything to do with GIFs. The actual vulnerability was caused by misconfigured DNS settings for *.teams.microsoft.com

egfx2• 6 years ago

Yes I know. I was referring to the title of the article.

lonelappde4• 6 years ago

Code is data. Data is code. The difference is metaphysics; the machine doesn't care. Any parseable data format has the potential to trigger a bug in the parser.

rmac• 6 years ago

... buried the lede

it's subdomain takeover

tantalor• 6 years ago

It's not buried; it's in the 2nd sentence of the abstract/summary:

"leveraging a subdomain takeover vulnerability"

bawolff• 6 years ago

Ugh, that was an annoying article. Clickbaity and burrying the lede which turned out to be very uninteresting

godelmachine2• 6 years ago

Just today I was joking with my colleagues on Teams - "Who is the Product Manager of Teams, and why hasn't Mr. Gates fired him/ her yet!"

At the peril of being downvoted, I am going to rant, but rant I shall.

Last year they tried to move all Skype users to Teams, which failed miserably. Today, they have tried doing the same, but to my much chagrin, the issue from last year still persists. We are not able to share screen with Skype users. One user just got irritated and left.

A few weeks ago they forgot to renew their SSL certificate, which is unacceptable for a corporation like Microsoft.

And now this. It makes me loathe Teams even more.

Shacklz2• 6 years ago

Teams has its issues, but compared to skype its amazing in my opinion. Granted, skype is a pretty low bar to compare with, but still.

At my last company, Teams was introduced as a tool besides skype - and everyone was encouraged to move meetings etc. whenever possible over to Teams. It worked out pretty well, after a few months skype meetings became the exception, almost everything, especially if only techies were included, was happening on Teams.

I recommend to give it a serious try, some of it features do suck (notification settings etc. are absolutely horrendous and seem to not properly work half the time) but overall it improved the ways people communicated a lot compared to skype. At least that was my experience :)

user59944612• 6 years ago

What's your issues with skype? It always worked well for me to chat with coworkers and do screenshare.

coribuci2• 6 years ago

Teams has its issues, but compared to skype its amazing in my opinion. Granted, skype is a pretty low bar to compare with, but still.

Yeah, it's amazing that such an aborted thing ever seen the day of life. Skype looks like a windows program. Team looks like an Android game.

About corporate: Skype can do a 250 people meeting, Teams can do only 100.

It is like in the old M$ joke: How wonderful it's gonna be when they will get it.

At my last company, Teams was introduced as a tool besides skype - and everyone was encouraged to move meetings etc. whenever possible over to Teams. It worked out pretty well, after a few months skype meetings became the exception, almost everything, especially if only techies were included, was happening on Teams.

In my company people preffer Skype.

I recommend to give it a serious try, some of it features do suck (notification settings etc. are absolutely horrendous and seem to not properly work half the time) but overall it improved the ways people communicated a lot compared to skype. At least that was my experience :)

It is a piece of crap. The only "feature" above skype is that it has these groups. From an UI point of view is a piece of crap. Who was the idiot that conceived such a crappy interface ? When i start a new chat i want a new chat not to see my last chat with someone else.

_hl_• 6 years ago

A few weeks ago they forgot to renew their SSL certificate

At the risk of posting an insubstantial comment, holy shit.

elsonrodriguez• 6 years ago

This is when I decided that Teams is hot garbage:

https://microsoftteams.uservoice.com/forums/555103-public/su... https://microsoftteams.uservoice.com/forums/555103-public/su...

It supports neither MacOS or Windows native notifications! On Mac this means all Teams notifications end up behind the native notifications.

FactolSarin• 6 years ago

I really do hate the lack of native notifications. It's ridiculous

mschuster912• 6 years ago

On Mac this means all Teams notifications end up behind the native notifications.

On the other hand, native Mac notifications are nowhere as feature rich as the custom Teams implementation.

bjelkeman-again• 6 years ago

Teams on the Mac is a UX disaster. Start the application, you get a Teams logo. Then it switches to a large white window, that can persist for up to 40seconds (100 mb fibre). No indication of what the app is doing. Downloading a full app every time? In some meetings I have lost the ability to access the chat. When trying to access recorded videos that I get a shared link to I end up with a login window that refuses to acknowledge any account (maybe I have no access, but that isn’t what it tells me). The resources section, files etc, is confusing to the point of being useless and old videos just tell me a token has expired.

baryphonic• 6 years ago

Teams on my Mac has this wonderful feature where the notifications render as a completely white rectangle until I mouseover, and then it finally renders the content.

harikb• 6 years ago

Teams has its issues, but this is a click bait article

First, the attacker needs to issue a certificate for the compromised sub-domains.

nogabebop232• 6 years ago

Yes - can someone shed some light on how someone would (a) compromise a subdmomain and (b) get a cert issued? This seems like you would need to be internal to the org, not the 3rd party exploit the article is trying to push?

mschuster912• 6 years ago

And now this. It makes me loathe Teams even more.

Yet, feature-wise, nothing comes even remotely close. Nothing Cisco offers (Webex is a trash dumpster fire), Skype for consumers is garbage, Skype for Business marginally better, and the FOSS crowd... Mattermost is a decent Slack alternative but no video calls, Jitsi is flattened against the video call capabilities of Teams and Asterisk can't even get a multi-party video call done. Zoom is video calls only, and appear.in/whereby too (plus Whereby tops out at 12 participants).

Hate to admit it but MS Teams is so far away the others might just call it quits, the only thing it would need to completely ditch Webex and S4B at my employer would be an easy way to invite totally random guests to video conferences and support for dial-in via telephone as fallback.

godelmachine2• 6 years ago

I don't see a direct comparison with Slack anywhere, so maybe you are tacitly conceding that Slack, by far, is the best collab tool

7952• 6 years ago

If you look at Microsoft features in isolation they are often really bad. But taken together they add up to something that is difficult to compete with. On the surface you get chat/video calls/and live streamed events. But you also get Sharepoint, Onedrive and integrations with all the other Microsoft products. You may be able to think of products that do one of those things better, but it is tough to replicate the entire ecosystem.

anonymousDan• 6 years ago

Teams UX sucks so bad. It's *&£+ing infuriatingly hard to create a simple meeting link.

p1necone• 6 years ago

Discord would tick all the boxes I care about, they'd have to pivot their marketing and "theme" a bit though. Or just release a separate corporate focused product that's still Discord under the hood.

baxtr2• 6 years ago

I read analysts report about slack from time to time. It is amusing. Many investor looking at it from a market perspective claim that MS will crush slack and potentially Zoom, because both are commodities included in your monthly 365 subscription. So reasonable companies will give up on the convenient slack and Zoom combo over time. I just don’t buy that simple logic because quality is simply ignored here. Your comment is in line with my thinking.

coribuci2• 6 years ago

Companies do not buy quality.They buy "integration". If your slack does not work with Office 365 you're doomed.

mns• 6 years ago

Companies ignore quality all the time to save costs. We're on the Office 365 bandwagon. We used Skype before company wide and Slack in IT. They made a group of seeing which tool is better. Slack ended up better, but Teams is free in our Office subscription, so now we are all on Teams (while in our team we still use Slack internally under the radar, especially because we have loads of useful plugins for builds, git, automation). Teams has some of those plugins, but it seems like some sort of cheap clone made with Material UI or Bootstrap that they just gobbled up in a few months to take on Slack. I ranted before about the notifications on Mac, about the support on Linux for some people, for us it doesn't even work with our conferencing equipment from Logitech (everything else works on a Mac with it, except Teams), but nobody cares, we have a good enough "free" solution.

badrabbit• 6 years ago

The issue is with skype. Even between mac and windows users you can't do desktop control,screen sharing never works for me either.

Teams is 1000x better than skype in my experience.

ChrisArchitect• 6 years ago

please change the title of this to remove the 'beware the gif' part if it doesn't have anything to do with the vulnerability really

nogabebop232• 6 years ago

Outside of my wheelhouse, but is the actual vulnerability here that legit domain has a legit subdomain CNAME record pointing at uncontrolled endpoint; $BAD_PERSON registers target domain and then tricks a user into hitting endpoint with credentials in cookies?

scottmcdot• 6 years ago

Putting subdomain takeover aside, are the gifs that are available to use in the chat pane all screened by Microsoft and deemed SFW (safe for work)? I see some of them are watermarked with 'giphy'. Does that mean if it's available on giphy.com it's available to share on Teams?

BiTSHiFT91• 6 years ago

As admin you can control the content restrictions for gifs. It’s like sfw, sketchy, nsfw If I recall correctly. But yes, if it’s on giphy it’s on teams.

Beware of the GIF: Account Takeover Vulnerability in Microsoft Teams

Related Stories