Microsoft Teams is storing authentication tokens in cleartext.

A safety vulnerability has been found in Microsoft Groups. A report that was printed by safety agency Vectra, reveals that Microsoft Groups is storing authentication tokens in cleartext.

Microsoft Groups safety concern

The vulnerability is current within the desktop variations of Groups for Home windows, macOS and Linux. Menace actors who’ve native (bodily) or distant entry to a sufferer’s system, can entry the credentials of customers who’re signed in, with out requiring administrator privileges. Hackers might bypass 2-factor authentication necessities even when it was enabled within the account, and entry different associated apps reminiscent of Skype and Outlook. This might doubtlessly be exploited to impersonate different customers, tamper with knowledge, or to engineer focused phishing assaults.

Picture courtesy: Unsplash

How the vulnerability was found

Vectra’s researchers had been engaged on a means to assist a consumer, who needed to delete previous accounts (inactive customers) from Microsoft Groups. The app doesn’t permit this, so that they seemed for a distinct means and found a few recordsdata. Considered one of these contained the authentication tokens that had been saved by Microsoft Groups, and these credentials had been in cleartext (unencrypted format). The opposite file, which was a browser cookies database, additionally had these tokens.

The safety agency created a proof-of-concept to check whether or not the loophole may very well be exploited permit entry to person accounts. It used the SQLite engine, to obtain the info to a neighborhood folder and extracted the Skype Entry token from it. This was then used to ship a take a look at message, proving that the vulnerability permits entry to different apps.
Such malicious ways may very well be utilized by hackers to penetrate organizations, pretending to be a CEO or CFO, to persuade different customers to carry out duties that might harm the corporate.

Vectra’s advisory explains that the Electron framework is to be blamed for the difficulty, because it doesn’t assist normal safety protocols reminiscent of encryption and system-protected folders out of the field. Ars Technica factors out that such safety vulnerabilities in Electron apps aren’t a brand new factor, they’ve been reported in WhatsApp, Skype, Slack over the previous couple of years. Vectra says that builders who use Electron should use OAuth of their apps to retailer the authentication tokens securely, for instance, by utilizing KeyTar.

Microsoft says this isn’t a critical concern

Microsoft has acknowledged the vulnerability, however an organization spokesperson informed safety weblog, Darkish Studying, that it has chosen to not patch the bug instantly. That is what it stated,

“The approach described doesn’t meet our bar for instant servicing because it requires an attacker to first acquire entry to a goal community

In different phrases, it says that until a person’s community is already compromised, both domestically or by way of malware (which can be utilized to set off distant code execution), this should not actually be a menace for many customers.

Connor Peoples, a safety architect at Vectra Safety, stated that since Microsoft is shifting towards Progressive Internet Apps, this may mitigate the problems which can be current in Electron. The safety agency has steered customers to not use the Microsoft Groups desktop app till the vulnerability has been patched, and as a substitute recommends utilizing Groups by way of an internet browser.

Abstract