Security experts at the US Navy have developed a tool to exploit a recently discovered flaw in Microsoft Teams.
Last month, the video conferencing software was found to have bug which allowed files sent from external accounts to be received into an organization's inbox, something that is supposed to be prohibited.
The red team at the US Navy has made a tool called TeamsPhisher that makes use of this flaw, which involves simply changing the ID in the POST request of a message to make Teams think that the external file send has actually come from an internal account, and is therefore accepted.
TeamsPhisher
Written in Python, the tool can carry out attacks with full autonomy. All the user has to do is write the accompanying message, attach the file and give it a list of targets to hit. It will work out which targets have external message reception turned on and only attack those, as this has to be enabled for the attack to work.
Another trick it uses is to make the new thread with the user a group chat by including the target's email twice. According to the description on the tool's GitHub page, this will, “bypass the “Someone outside your organization messaged you, are you sure you want to view it” splash screen that can give our targets reason for pause.”
The message is sent to the user and the attachment will be linked in the user's Sharepoint.
TeamsPhisher also requires the targets to have Microsoft Business accounts with a Teams and Sharepoint license, which many companies who use Teams will. The tool can also delay messages to prevent running up against rate limits, as well as write its outputs to a log file.
A threat actor could use TeamsPhisher to deliver malware to Teams users who have external messaging turned on. Microsoft has not yet fixed the issue, and said that it isn't even serious enough to merit immediate attention from the company.
It also said that it is aware of the new TeamsPhisher tool and notes that it relies on social engineering to work, so is advising users merely to be cautious when receiving any links or attachments.
Users can disable external messages by navigating to the Microsoft Teams Admin Center and then to External Access. If users do not wish to block all external communications, then they can choose to communicate with trusted domains only by adding them to the allow list.
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba