16 ms·

Beware of the GIF: Account Takeover Vulnerability in Microsoft Teams

166 points by jrenshaw 6y ago

abluecloud 6y ago
I'm confused as to how they do the sub domain takeover.
- zaroth 6y ago
  Came here to ask the exact same question. TLDR; Authorization cookie for an important Account API is sent to *.teams.microsoft.com and they got control of a subdomain of that somehow.
- cotillion 6y ago
  Those records probably pointed to an ip or a CNAME which was not registered or not under microsoft control. But some more information on that mistake would have been nice.
- munchbunny 6y ago
  I had to read up on it, the gist of it is (these are example domain names I made up for illustration): 1. Domain like "abcde.teams.microsoft.com" has a CNAME that points to a domain like "abcde.microsoft-teams.com", but "microsoft-teams.com" is no longer registered to or controlled by Microsoft. 2. Hacker registers microsoft-teams.com, gets a LetsEncrypt SSL for it. 3. Send a message to someone with a GIF that was uploaded to "abcde.teams.microsoft.com". Teams thinks it's legit because it's a subdomain of "teams.microsoft.com", and SSL checks out, so it sends the user's auth token along with the HTTP request for the GIF. Problem is, it's sending it to the attacker controlled "abcde.microsoft-teams.com". 4. Since the hacker controls "abcde.microsoft-teams.com", they now have your auth token, which they can use to impersonate you. Et voila, account takeover. I'd bet that plenty of whitehats and blackhats have bots automatically crawling domains belonging to tech companies searching for subdomain takeover opportunities.
  - tidepod12 6y ago
    >Domain like "abcde.teams.microsoft.com" has a CNAME that points to a domain like "abcde.microsoft-teams.com", but "microsoft-teams.com" is no longer registered to or controlled by Microsoft. Can you elaborate a bit on this? I get that these are example domains, but why would "abcde.teams.microsoft.com" (which is presumably controlled by Microsoft) point to a domain "microsoft-teams.com" that is not controlled by Microsoft? Was that a mistake on Microsoft's part, or did the attackers do something clever to gain control of that domain/point a Microsoft-owned subdomain to the attacker's domain?
    - munchbunny 6y ago
      Yup, in my hypothetical example, at some point "microsoft-teams.com" was registered by Microsoft. At that time, some engineer deployed something that involved the CNAME. Over time, "microsoft-teams.com" was moved elsewhere and the domain became unregistered, but the engineer maybe forgot or left the team, and nobody remembered that there's this out of date "abcde.teams.microsoft.com" DNS record just sitting there. Microsoft has a lot of these, just random Microsoft-ish domains that were used at one point or another. It's a problem because it makes it harder to look at the domain name as a sanity check against phishing.
    - gnopgnip 6y ago
      Microsoft and other large companies are made up of many smaller groups, and to make this work there are a lot of extra rules. For the most part those rules serve a purpose and the benefit outweighs the cost. Sometimes these rules create extra problems, because of how people actually make choices and use the resulting system. It is likely there is a detailed change approval process for updating a *.microsoft.com DNS record. Or that only certain depts can make changes, and only for certain reasons. Someone involved with Teams avoided that by using a separate domain and a cname record, then they could update their separate domain records more easily. Later someone forgot to register this domain, and/or forgot to update the DNS to somewhere that is over their control, or forgot to put in sufficient checks to prevent tokens being shared with unauthorized servers.
  - deleted 6y ago
    [deleted]
ThePowerOfFuet 6y ago
Shame they totally skipped the whole sub domain takeover bit, which was required for the exploit to work.
- hundchenkatze 6y ago
  I guess a DNS configuration issue doesn't drive as many clicks.
- lonelappde 6y ago
  General info: https://www.hackerone.com/blog/Guide-Subdomain-Takeovers https://www.hackerone.com/blog/Guide-Subdomain-Takeovers
eugenekolo 6y ago
Weird lead in about GIFs to simply saying they had a subdomain takeover.
- lonelappde 6y ago
  Clickbait.
A4ET8a8uTh0 6y ago
I was always confused by seeing those types of exploits. In my head, I could not see why would GIF cause anything other show up on screen. But then I remember I think of offline activity. All that said, and please excuse my ignorance here, but how common is it for subdomain not to be under the control of its owner?
- msla 6y ago
  > All that said, and please excuse my ignorance here, but how common is it for subdomain not to be under the control of its owner? This is how FreeDNS works: There's lots of domains which are donated to the project, and people can register subdomains of those domains and have them point to their own systems, with software to ensure the DNS records stay up-to-date even in the face of dynamic IP addresses. https://freedns.afraid.org/faq/ https://freedns.afraid.org/faq/
- floatingatoll 6y ago
  2018: You CNAME subdomain.microsoft.com. to blahblahblah.heroku.com. 2019: You replace blahblahblah and shut it down on Heroku 2020: An attacker creates blahblahblah.heroku.com. and can now read and write cookies for *.microsoft.com. Replace Heroku with any off-domain hosting service that lets you register a vanity or predictable hostname rather than assigning a GUID.
thyrsus 6y ago
This is why one should not automatically load external content in e-mails. This Forbes article covers the same territory: https://www.forbes.com/sites/thomasbrewster/2020/04/27/your-whole-companys-microsoft-teams-data-couldve-been-stolen-with-an-evil-gif/ https://www.forbes.com/sites/thomasbrewster/2020/04/27/your-... I have to say, these headlines immediately made me think of this long ago fixed bug: https://www.cvedetails.com/cve/CVE-2008-2160/ https://www.cvedetails.com/cve/CVE-2008-2160/
- lonelappde 6y ago
  That's not what this bug is about. The bug is not to do with the content, but merely the connection. And it's only "external" because Microsoft relinquished control of its internal system but still treated it as internal.
egfx 6y ago
Wasn’t WhatsApp also compromised via gif? Gif is a really remarkable format that seems so simple but it’s much more. It’s just a series of images with timings but then you realize that the first few bits of the gif can be written with arbitrary code. A somewhat deep dive into the format https://enthusiasms.org/post/16976438906 https://enthusiasms.org/post/16976438906
- stri8ed 6y ago
  This attack does not depend on the GIF. It could just as well have been a JPEG.
- hundchenkatze 6y ago
  Except in this case it didn't really have anything to do with GIFs. The actual vulnerability was caused by misconfigured DNS settings for *.teams.microsoft.com
  - egfx 6y ago
    Yes I know. I was referring to the title of the article.
- lonelappde 6y ago
  Code is data. Data is code. The difference is metaphysics; the machine doesn't care. Any parseable data format has the potential to trigger a bug in the parser.
rmac 6y ago
... buried the lede it's subdomain takeover
- tantalor 6y ago
  It's not buried; it's in the 2nd sentence of the abstract/summary: "leveraging a subdomain takeover vulnerability"
bawolff 6y ago
Ugh, that was an annoying article. Clickbaity and burrying the lede which turned out to be very uninteresting
godelmachine 6y ago
Just today I was joking with my colleagues on Teams - "Who is the Product Manager of Teams, and why hasn't Mr. Gates fired him/ her yet!" At the peril of being downvoted, I am going to rant, but rant I shall. Last year they tried to move all Skype users to Teams, which failed miserably. Today, they have tried doing the same, but to my much chagrin, the issue from last year still persists. We are not able to share screen with Skype users. One user just got irritated and left. A few weeks ago they forgot to renew their SSL certificate, which is unacceptable for a corporation like Microsoft. And now this. It makes me loathe Teams even more.
- Shacklz 6y ago
  Teams has its issues, but compared to skype its amazing in my opinion. Granted, skype is a pretty low bar to compare with, but still. At my last company, Teams was introduced as a tool besides skype - and everyone was encouraged to move meetings etc. whenever possible over to Teams. It worked out pretty well, after a few months skype meetings became the exception, almost everything, especially if only techies were included, was happening on Teams. I recommend to give it a serious try, some of it features do suck (notification settings etc. are absolutely horrendous and seem to not properly work half the time) but overall it improved the ways people communicated a lot compared to skype. At least that was my experience :)
  - user5994461 6y ago
    What's your issues with skype? It always worked well for me to chat with coworkers and do screenshare.
    - Shacklz 6y ago
      Yeah, you pretty much summed up all features of skype. You can chat and you can screenshare. However, I do expect a little bit more than that in 2020 to be honest - I wanna be able to paste code snippets or the like without having to fear that skype introduces some weird special characters when copying it out of skype again (which caused super weird issues more than once). I want to talk asynchronously: Skype (at least in the for-business variant that I know) is very intrusive; if someone messages you you get a window in the face, and if you click it away you have to do some seriously weird digging to see the message again. Similarly, I want chat persistence that is not an absolute pain in the butt: If I wanna check what a colleague sent me three days ago in a chat, this has to be like one or two clicks away, not scrolling through stuff. I want to talk to multiple people at once regularly (a team, a workgroup, you name it) without having to set up the group every single time. I want to share GIFs and pictures, not just links. ... hope that gives you a bit of an idea on why I'm not particularly fond of skype :)
ChrisArchitect 6y ago
please change the title of this to remove the 'beware the gif' part if it doesn't have anything to do with the vulnerability really
nogabebop23 6y ago
Outside of my wheelhouse, but is the actual vulnerability here that legit domain has a legit subdomain CNAME record pointing at uncontrolled endpoint; $BAD_PERSON registers target domain and then tricks a user into hitting endpoint with credentials in cookies?
scottmcdot 6y ago
Putting subdomain takeover aside, are the gifs that are available to use in the chat pane all screened by Microsoft and deemed SFW (safe for work)? I see some of them are watermarked with 'giphy'. Does that mean if it's available on giphy.com it's available to share on Teams?
- BiTSHiFT91 6y ago
  As admin you can control the content restrictions for gifs. It’s like sfw, sketchy, nsfw If I recall correctly. But yes, if it’s on giphy it’s on teams.

166 points by jrenshaw 6y ago

abluecloud 6y ago

I'm confused as to how they do the sub domain takeover.

zaroth 6y ago
Came here to ask the exact same question. TLDR; Authorization cookie for an important Account API is sent to *.teams.microsoft.com and they got control of a subdomain of that somehow.
cotillion 6y ago
Those records probably pointed to an ip or a CNAME which was not registered or not under microsoft control. But some more information on that mistake would have been nice.
munchbunny 6y ago
I had to read up on it, the gist of it is (these are example domain names I made up for illustration): 1. Domain like "abcde.teams.microsoft.com" has a CNAME that points to a domain like "abcde.microsoft-teams.com", but "microsoft-teams.com" is no longer registered to or controlled by Microsoft. 2. Hacker registers microsoft-teams.com, gets a LetsEncrypt SSL for it. 3. Send a message to someone with a GIF that was uploaded to "abcde.teams.microsoft.com". Teams thinks it's legit because it's a subdomain of "teams.microsoft.com", and SSL checks out, so it sends the user's auth token along with the HTTP request for the GIF. Problem is, it's sending it to the attacker controlled "abcde.microsoft-teams.com". 4. Since the hacker controls "abcde.microsoft-teams.com", they now have your auth token, which they can use to impersonate you. Et voila, account takeover. I'd bet that plenty of whitehats and blackhats have bots automatically crawling domains belonging to tech companies searching for subdomain takeover opportunities.
- tidepod12 6y ago
  >Domain like "abcde.teams.microsoft.com" has a CNAME that points to a domain like "abcde.microsoft-teams.com", but "microsoft-teams.com" is no longer registered to or controlled by Microsoft. Can you elaborate a bit on this? I get that these are example domains, but why would "abcde.teams.microsoft.com" (which is presumably controlled by Microsoft) point to a domain "microsoft-teams.com" that is not controlled by Microsoft? Was that a mistake on Microsoft's part, or did the attackers do something clever to gain control of that domain/point a Microsoft-owned subdomain to the attacker's domain?
  - munchbunny 6y ago
    Yup, in my hypothetical example, at some point "microsoft-teams.com" was registered by Microsoft. At that time, some engineer deployed something that involved the CNAME. Over time, "microsoft-teams.com" was moved elsewhere and the domain became unregistered, but the engineer maybe forgot or left the team, and nobody remembered that there's this out of date "abcde.teams.microsoft.com" DNS record just sitting there. Microsoft has a lot of these, just random Microsoft-ish domains that were used at one point or another. It's a problem because it makes it harder to look at the domain name as a sanity check against phishing.
  - gnopgnip 6y ago
    Microsoft and other large companies are made up of many smaller groups, and to make this work there are a lot of extra rules. For the most part those rules serve a purpose and the benefit outweighs the cost. Sometimes these rules create extra problems, because of how people actually make choices and use the resulting system. It is likely there is a detailed change approval process for updating a *.microsoft.com DNS record. Or that only certain depts can make changes, and only for certain reasons. Someone involved with Teams avoided that by using a separate domain and a cname record, then they could update their separate domain records more easily. Later someone forgot to register this domain, and/or forgot to update the DNS to somewhere that is over their control, or forgot to put in sufficient checks to prevent tokens being shared with unauthorized servers.
- deleted 6y ago
  [deleted]

ThePowerOfFuet 6y ago

Shame they totally skipped the whole sub domain takeover bit, which was required for the exploit to work.

hundchenkatze 6y ago
I guess a DNS configuration issue doesn't drive as many clicks.
lonelappde 6y ago
General info: https://www.hackerone.com/blog/Guide-Subdomain-Takeovers https://www.hackerone.com/blog/Guide-Subdomain-Takeovers

eugenekolo 6y ago

Weird lead in about GIFs to simply saying they had a subdomain takeover.

lonelappde 6y ago
Clickbait.

A4ET8a8uTh0 6y ago

I was always confused by seeing those types of exploits. In my head, I could not see why would GIF cause anything other show up on screen. But then I remember I think of offline activity. All that said, and please excuse my ignorance here, but how common is it for subdomain not to be under the control of its owner?

msla 6y ago
> All that said, and please excuse my ignorance here, but how common is it for subdomain not to be under the control of its owner? This is how FreeDNS works: There's lots of domains which are donated to the project, and people can register subdomains of those domains and have them point to their own systems, with software to ensure the DNS records stay up-to-date even in the face of dynamic IP addresses. https://freedns.afraid.org/faq/ https://freedns.afraid.org/faq/
floatingatoll 6y ago
2018: You CNAME subdomain.microsoft.com. to blahblahblah.heroku.com. 2019: You replace blahblahblah and shut it down on Heroku 2020: An attacker creates blahblahblah.heroku.com. and can now read and write cookies for *.microsoft.com. Replace Heroku with any off-domain hosting service that lets you register a vanity or predictable hostname rather than assigning a GUID.

thyrsus 6y ago

This is why one should not automatically load external content in e-mails. This Forbes article covers the same territory: https://www.forbes.com/sites/thomasbrewster/2020/04/27/your-whole-companys-microsoft-teams-data-couldve-been-stolen-with-an-evil-gif/ https://www.forbes.com/sites/thomasbrewster/2020/04/27/your-... I have to say, these headlines immediately made me think of this long ago fixed bug: https://www.cvedetails.com/cve/CVE-2008-2160/ https://www.cvedetails.com/cve/CVE-2008-2160/

lonelappde 6y ago
That's not what this bug is about. The bug is not to do with the content, but merely the connection. And it's only "external" because Microsoft relinquished control of its internal system but still treated it as internal.

egfx 6y ago

Wasn’t WhatsApp also compromised via gif? Gif is a really remarkable format that seems so simple but it’s much more. It’s just a series of images with timings but then you realize that the first few bits of the gif can be written with arbitrary code. A somewhat deep dive into the format https://enthusiasms.org/post/16976438906 https://enthusiasms.org/post/16976438906

stri8ed 6y ago
This attack does not depend on the GIF. It could just as well have been a JPEG.
hundchenkatze 6y ago
Except in this case it didn't really have anything to do with GIFs. The actual vulnerability was caused by misconfigured DNS settings for *.teams.microsoft.com
- egfx 6y ago
  Yes I know. I was referring to the title of the article.
lonelappde 6y ago
Code is data. Data is code. The difference is metaphysics; the machine doesn't care. Any parseable data format has the potential to trigger a bug in the parser.

rmac 6y ago

... buried the lede it's subdomain takeover

tantalor 6y ago
It's not buried; it's in the 2nd sentence of the abstract/summary: "leveraging a subdomain takeover vulnerability"

bawolff 6y ago

Ugh, that was an annoying article. Clickbaity and burrying the lede which turned out to be very uninteresting

godelmachine 6y ago

Just today I was joking with my colleagues on Teams - "Who is the Product Manager of Teams, and why hasn't Mr. Gates fired him/ her yet!" At the peril of being downvoted, I am going to rant, but rant I shall. Last year they tried to move all Skype users to Teams, which failed miserably. Today, they have tried doing the same, but to my much chagrin, the issue from last year still persists. We are not able to share screen with Skype users. One user just got irritated and left. A few weeks ago they forgot to renew their SSL certificate, which is unacceptable for a corporation like Microsoft. And now this. It makes me loathe Teams even more.

Shacklz 6y ago
Teams has its issues, but compared to skype its amazing in my opinion. Granted, skype is a pretty low bar to compare with, but still. At my last company, Teams was introduced as a tool besides skype - and everyone was encouraged to move meetings etc. whenever possible over to Teams. It worked out pretty well, after a few months skype meetings became the exception, almost everything, especially if only techies were included, was happening on Teams. I recommend to give it a serious try, some of it features do suck (notification settings etc. are absolutely horrendous and seem to not properly work half the time) but overall it improved the ways people communicated a lot compared to skype. At least that was my experience :)
- user5994461 6y ago
  What's your issues with skype? It always worked well for me to chat with coworkers and do screenshare.
  - Shacklz 6y ago
    Yeah, you pretty much summed up all features of skype. You can chat and you can screenshare. However, I do expect a little bit more than that in 2020 to be honest - I wanna be able to paste code snippets or the like without having to fear that skype introduces some weird special characters when copying it out of skype again (which caused super weird issues more than once). I want to talk asynchronously: Skype (at least in the for-business variant that I know) is very intrusive; if someone messages you you get a window in the face, and if you click it away you have to do some seriously weird digging to see the message again. Similarly, I want chat persistence that is not an absolute pain in the butt: If I wanna check what a colleague sent me three days ago in a chat, this has to be like one or two clicks away, not scrolling through stuff. I want to talk to multiple people at once regularly (a team, a workgroup, you name it) without having to set up the group every single time. I want to share GIFs and pictures, not just links. ... hope that gives you a bit of an idea on why I'm not particularly fond of skype :)

ChrisArchitect 6y ago

please change the title of this to remove the 'beware the gif' part if it doesn't have anything to do with the vulnerability really

nogabebop23 6y ago

Outside of my wheelhouse, but is the actual vulnerability here that legit domain has a legit subdomain CNAME record pointing at uncontrolled endpoint; $BAD_PERSON registers target domain and then tricks a user into hitting endpoint with credentials in cookies?

scottmcdot 6y ago

Putting subdomain takeover aside, are the gifs that are available to use in the chat pane all screened by Microsoft and deemed SFW (safe for work)? I see some of them are watermarked with 'giphy'. Does that mean if it's available on giphy.com it's available to share on Teams?

BiTSHiFT91 6y ago
As admin you can control the content restrictions for gifs. It’s like sfw, sketchy, nsfw If I recall correctly. But yes, if it’s on giphy it’s on teams.