10 ms·

I wrote this. This is one of five similar reports for MS Teams. Even outside RCE, just consider the impact of access to SSO tokens and wormability :)

artjomb 6y ago
Could you provide a disclosure timeline and the version or indication of the version which has fixed this issue?
- oskarsv 6y ago
  you can find both disclosure dates and versions in the report. As for when it was fixed - I have no idea, as they never told me, one day it just was.
  - GekkePrutser 6y ago
    Thank you for reporting it and not selling it on the black market! I agree the categorisation is very bad. I hope raising this here will help you getting rewarded properly.
    - driverdan 6y ago
      > Thank you for reporting it and not selling it on the black market! I disagree. If MS is going to treat major issues like this then researchers should be selling them to the highest bidder. Maybe that way they'll actually treat disclosures properly.
      - Zenbit_UX 6y ago
        Pretty bold to advocate for blackhat behavior on one of the most schoolboy vanilla places on the internet, but I can't say I necessarily disagree with your sentiment, big tech needs a lesson but is this really the vulnerability we want? 115 million DAU on teams... The amount of damage the NSA or some other state sponsored actor could do with this... It would be very bad to say the least. How bad depends on which state acquires it. If a script kiddy got it they would likely do a mass randomware infection, hospitals would get hit, people would die. Millions in crypto would be lost to unencrypted wallets found on the vulnerable machines (yes people do that..), this could cause some to lose their life savings... People have commit suicide for less. My point is its important to look past FAANG being cheap and look at 2nd and 3rd order effects from something this powerful and widespread.
        mistrial9 6y ago
        > look at 2nd and 3rd order effects .. which FOSS engineers have spent their lives on, while FAANG acumulates patent and SSL money across international borders? forcing TEAMS kool-aid with surveillance built-in, down your desktop with the help of C-Suite and their attorneys?
        woodruffw 6y ago
        Governments around the world already regularly trade in exploits that are as or more severe than this one. That isn’t to advocate for brokering to a government, just to say that the market already exists and contains comparable exploits. It’s only a matter of time until we see the next EternalBlue to WannaCry lifecycle.
        corty 6y ago
        The ethical thing to do is immediate full disclosure, not selling it and not this (ir)responsible disclosure crap.
      - mwcampbell 6y ago
        > researchers should be selling them to the highest bidder But what about all of the innocent people who would be harmed by such a callous approach? I'm glad some researchers have a conscience.
        iforgotpassword 6y ago
        > But what about all of the innocent people who would be harmed by such a callous approach? They should then think again about their choice of using teams. Why should Microsoft rake in money from a shabby product while volunteers have to fix their shit? Assigning a ridiculously low score to significantly lower the bounty as a billion dollar company is disgusting.
        untog 6y ago
        > They should then think again about their choice of using teams. What percentage of Teams users do you think have a choice in their use of Teams?
        the8472 6y ago
        If it's on their work machines then it primarily endangers their employer's data, much less their own.
        airstrike 6y ago
        And then when the company loses business from the disruption, do you think employees walk away scot-free?
        the8472 6y ago
        I consider that inherent risk. Not getting a raise because the company made business decisions that turned out suboptimal (such as gaining short-term profits by not investing IT security) is a risk that any employee faces. If you want a more stable environment you go for a more risk-averse employer, perhaps even public sector jobs.
      - MrDresden 6y ago
        While I get your sentiment, I must disagree. Profiting from the very likely unethical use of the exploit would be unethical. Instead this mishandling by M$ should rather cause researchers to publicly announce the vulnerabilities which would hopefully cause M$ to change their ways in future dealings. It is ofcourse easy for me to say this, not being a researcher who lives off of the discoveries made.
        krageon 6y ago
        Participating in a system that exploits researchers for free labour using societal guilt-tripping is the unethical move here. That means you.
        MrDresden 6y ago
        I see you completely missed my point. My point is that in the case of M$ the defects could be publicly announced to all parties at once as a way of making M$ realize that how bad their handling is/was. In all likelyhood this shouldn't have to happen for too long before they would realize their mistake. Many other corporations do indeed value the discoveries of researchers and do pay accordingly for being notified. Never did I suggest that this should become the industry norm (i.e not paying for private disclosures). Now what ever your personal feelings on that idea is, it does not change the fact that selling exploits to other parties would be unethical. Furthermore, participating in a system that promotes assumptions and flawed reading comprehension is not conductive to a good discourse. That means you.
      - rndgermandude 6y ago
        Thing is, we don't know if this was found before by malicious actors and sold and/or abused. This thing sounds like it is mostly pretty straight forward to find once you start looking - "you" being somebody experienced in this field of research, that is. At least you don't have to construct fancy weird machines (with type confusion, heap spraying and all those shenanigans). It comes down to finding something that can perform code execution in their internal API (here: "electronSafeIpc") and then finding a way to get there (here: angular escape bypass/not-properly-sanitized user provided data) and you can do both in javascript and don't have to read tons of machine code. Given that Teams is a great target because of it's large and often corporate user base, I'd be surprised if none of the usual industrial espionage suspects (e.g. China, NSA, etc) had a look at Teams before. And I'd think the chance of them having found the same bug, or a related bug, once they looked is pretty good too. From what I am hearing even the (US) military uses Teams sometimes... If that isn't incentive to look at this thing for "interested parties", then I don't know.
        oskarsv 6y ago
        please check out how much code MS Teams actually has, before statements like this :) (it’s more than 30MB of compressed JS)
        rndgermandude 6y ago
        I didn't want to belittle your work, if you think that was the case. It's still outstanding to find things like that on your own, and a lot of work goes into it. Sorry if I gave the wrong impression. I have analyzed foreign code bases of similar dimensions in the past myself and found critical bugs. The size doesn't say much, it comes down to identifying the "interesting" bits (like the electronSafeRpc in this case), which can be hard and tedious, but greatly reduces the code you have to look at in detail. My assertion is that if your name is e.g. China then you will not be turned off by that.
        oskarsv 6y ago
        that electronSafeIpc API is actually not that interesting and a completely standard way to do things for ElectronJS apps. No, I do agree - from my perspective C/C++ class bugs are more difficult. Maybe they see this as magic as well. Still, it was painstaking work and in either case CountryX will easily surpass those difficulties.
      - SkyPuncher 6y ago
        "Locks can be picked so everyone should break into homes to proved a point" Lol, no.
        the8472 6y ago
        That most locks are pickable is common knowledge and that is why high-risk targets invest in additional security beyond locks. That crufty electron apps are a security risk is not. So yes, you do need someone to run out into the streets and yell that the emperor has no clothes. Otherwise common knowledge will not be established.
      - Wowfunhappy 6y ago
        Aside from the harm this could inflict on innocent users, I’m not actually convinced it would cause vendors to change their behavior. From a business perspective, the reason exploits are bad for companies is because they generate bad press, right? Well, it's not obvious to me that an exploit which was being used in the wild gets significantly worse press than one which was not. There's also the possibility the buyer will reserve an exploit for super-targeted attacks, and the public won't find out at all until year later.
      - coldtea 6y ago
        Yeah, that will show 'em... Then people will move to some understuffed FOSS alternative with 5 people working part-time on it, with as severe bugs that nobody notices (remember Heartbleed and countless others?)...
        higerordermap 6y ago
        Imagine thinking people move to FOSS alternatives. Imagine thinking PHBs at most companies even care about security.
      - stjohnswarts 6y ago
        you could be a grey hat if you averaged out one exploit turned in to the proper group to one exploit sold to the highest bidder. Flip a coin to be a real greyhat
      - mNovak 6y ago
        If the bounty money borders on insignificant, there's always public shaming. Demo the exploit in a controlled environment, and let the media cycle go.
        rasz 6y ago
        why controlled? Last time some dude got frustrated and started dropping zero days pretty much weekly Microsoft finally hired him to make it stop.
      - 314 6y ago
        So the people / companies who would be hacked and have their data / systems destroyed are what? Acceptable collateral damage?
    - krageon 6y ago
      Not selling this is the real crime here. Microsoft's conduct in this case deserves much worse than just that. Hoping for a reward now is obviously not going to happen - the best you can hope for as a response to an act like this is legal action. In a vindictive way, you can definitely hope they will get significantly damaged by this and in that way learn their lesson, but I doubt it.
  - csnover 6y ago
    Sorry if I am just obtuse but I don’t see a timeline in the linked report on GitHub. All I can see is that you tested against a version of Teams from 2020-08-31. Being able to see the complete timeline of communication with MS from discovery to public disclosure is not necessary but would give a more complete picture of how this went down, and I’d like to see it too if it’s not such a hassle.
    - oskarsv 6y ago
      There is no timeline besides when I reported it and now minus 2wks. They never told me when the fix was deployed. There is little value in going through the email chains to note each date:(. Final decision was made 2020-11-19
      - politelemon 6y ago
        Could you put that in the README, is what we're asking, as vague as it may be. At the moment the 'has been fixed' is the only clue to this in terms of resolution, and it's tucked away; without it it looks like most of the README is attempting to capitalize on the shock/outrage factor. Edit: Thanks, author has added some dates. https://github.com/oskarsve/ms-teams-rce/commit/35eac619fdef8015b70d8a7119965538daed8e05 https://github.com/oskarsve/ms-teams-rce/commit/35eac619fdef...
tclancy 6y ago
Is there any tell-tale sign this happened to you? I had a really weird experience on Mac last week: I opened up my machine and when I focused on teams I got a security alert saying something called Endgame from Elastico was demanding permissions. Never downloaded it but there it was in Applications.
- oskarsv 6y ago
  no, as you can see in the first demo it could be completely silent. not saying you are safe - I don’t know :)
- eqvinox 6y ago
  It is technically never possible to guarantee tell-tale signs of an RCE. At the point where you're running compromised code, that code could in most cases be constructed as to erase its own tracks. There might be some visible sign at the moment of exploitation, but after that it's kinda over. (Yes this assumes the RCE escalates to a reasonably high privilege, but that's just a matter of chaining. You can try to go for things like sealed logs, but ultimately arbitrary code can put your machine in an arbitrary state.) Particularly insidious for this would be the case of data theft. The RCE might load some code to upload your company secrets and keep itself strictly in RAM, and then erase itself when done. With enough blackhat craftiness you'd never be able to pinpoint the exact location of the leak.
- gnfargbl 6y ago
  Is this a work Mac? If so then it is likely managed through some kind of MDM system (JAMF etc), and it wouldn't be unreasonable for the owner of the hardware to be pushing down an endpoint agent like Elastic Endgame. Check in with your security team and ask them.
- hundchenkatze 6y ago
  If you're using an employer provided computer then they've likely installed Endgame[0] which is an endpoint (it runs on each device) security tool. Endgame was acquired by Elastic[1] last year [0] https://en.wikipedia.org/wiki/Endgame,_Inc https://en.wikipedia.org/wiki/Endgame,_Inc. [1] https://en.wikipedia.org/wiki/Elastic_NV https://en.wikipedia.org/wiki/Elastic_NV
thawab 6y ago
Have you been tempted to build a worm and click send? not to brake anything, just a text popup with an optimistic optimistic quote.
- deleted 6y ago
  [deleted]
- oskarsv 6y ago
  only as a thought exercise. the ability to 'switch off the internet' (115 million daily active big corp users) is tempting, but no, not really :)
  - jojobas 6y ago
    That's one way to force them to not make bug like that "important, spoofing" and "out of scope".
- throwaway201103 6y ago
  Google Robert Morris to find out how that goes.
  - thawab 6y ago
    From his wikipedia: He is a longtime friend and collaborator of Paul Graham. Graham dedicated his book ANSI Common Lisp to Morris. Graham lists Morris as one of his personal heroes, saying "he's never wrong." to be friends with Paul Graham, i should make a worm. Got it.
    - xyzzy123 6y ago
      Ehh in 1988 that worm was like an alien artifact from the cyberpunk future. First "real" worm code, multi-platform, multiple payloads, "staging", first practical buffer overflow exploit and it does credential brute-forcing. Heck it was not until nearly a decade later that people were really doing buffer overflows, and there were a LOT of easy overflows to be found. I'd make the case rtm didn't just "make a worm" he foreshadowed the next few decades of computer exploitation. Took a whole bunch of research and ideas, synthesised them, built an actual working "product" a decade or two ahead of its time and released it in a transgressive way. If you are the kind of person who can do that I'm sure lots of people would like to be friends with you.
ROARosen 6y ago
There is, however, some consolation in the fact that only an individual who is already connected to you in Teams can run this. That's not to say - of course - it's not abuse-able, it just gives some context to the fact threat MS calls this "Spoofing", since presumably, your Teams contact is someone you trust. So the bad actor is "spoofing" as someone trustable within your org (or outside it). But is does prob need some social-engineering for a bad actor to truly exploit this. But the threat is still sever since the above logic only holds up to the point-of-entry, once the worm has infected someone the people forwarding it around are truly trusted.
- csnover 6y ago
  One of my health care providers use Microsoft Teams as their telehealth solution. My city government uses Microsoft Teams for some public meetings. The idea that folks are only using Teams to connect with other trusted parties is comforting, but false.
  - noir_lord 6y ago
    > Microsoft Teams as their telehealth solution That sounds..interesting. I suspect with the on-going pandemic lots of tools are getting used in interesting ways they where never really designed for just to keep things going.
    - csnover 6y ago
      It’s bad, but it’s mostly bad because Teams is bad. It’s still better than Amwell, which somehow manages to have multi-second latencies and requires me to manually mute my video preview to stop it looping back my own audio. The old P2P Skype had better video quality and latency, even when talking to people 4000 miles away, than every video product I’ve used in the last year. Probably not coincidentally, every video product I’ve used in the last year has been web-based. WebRTC is an enormous disappointment.
    - kritiko 6y ago
      Microsoft advertises Teams for telehealth: https://www.microsoft.com/en-us/microsoft-365/microsoft-teams/healthcare-solutions https://www.microsoft.com/en-us/microsoft-365/microsoft-team...
jacquesm 6y ago
Thank you for making the internet slightly better.
edwintorok 6y ago
Could you clarify the "one of five" statement please? Are the other 4 vulnerabilities still unfixed, or they are fixed but a write-up is still pending? If there are still 4 unfixed RCE bugs in Teams I'd rather people uninstall Teams than wait for the fix...
- draugadrotten 6y ago
  It would be safest to assume that you have at least one unfixed RCE bug in Team, even if oskar did not discover it yet.
jeltz 6y ago
Maybe I missed it but I do not understand why injecting a null byte allowed you to bypass Angukar's protections. Is that a bug in Angular and if do is it fixed?

artjomb 6y ago

Could you provide a disclosure timeline and the version or indication of the version which has fixed this issue?

oskarsv 6y ago
you can find both disclosure dates and versions in the report. As for when it was fixed - I have no idea, as they never told me, one day it just was.
- GekkePrutser 6y ago
  Thank you for reporting it and not selling it on the black market! I agree the categorisation is very bad. I hope raising this here will help you getting rewarded properly.
  - driverdan 6y ago
    > Thank you for reporting it and not selling it on the black market! I disagree. If MS is going to treat major issues like this then researchers should be selling them to the highest bidder. Maybe that way they'll actually treat disclosures properly.
    - Zenbit_UX 6y ago
      Pretty bold to advocate for blackhat behavior on one of the most schoolboy vanilla places on the internet, but I can't say I necessarily disagree with your sentiment, big tech needs a lesson but is this really the vulnerability we want? 115 million DAU on teams... The amount of damage the NSA or some other state sponsored actor could do with this... It would be very bad to say the least. How bad depends on which state acquires it. If a script kiddy got it they would likely do a mass randomware infection, hospitals would get hit, people would die. Millions in crypto would be lost to unencrypted wallets found on the vulnerable machines (yes people do that..), this could cause some to lose their life savings... People have commit suicide for less. My point is its important to look past FAANG being cheap and look at 2nd and 3rd order effects from something this powerful and widespread.
      - mistrial9 6y ago
        > look at 2nd and 3rd order effects .. which FOSS engineers have spent their lives on, while FAANG acumulates patent and SSL money across international borders? forcing TEAMS kool-aid with surveillance built-in, down your desktop with the help of C-Suite and their attorneys?
      - woodruffw 6y ago
        Governments around the world already regularly trade in exploits that are as or more severe than this one. That isn’t to advocate for brokering to a government, just to say that the market already exists and contains comparable exploits. It’s only a matter of time until we see the next EternalBlue to WannaCry lifecycle.
      - corty 6y ago
        The ethical thing to do is immediate full disclosure, not selling it and not this (ir)responsible disclosure crap.
    - mwcampbell 6y ago
      > researchers should be selling them to the highest bidder But what about all of the innocent people who would be harmed by such a callous approach? I'm glad some researchers have a conscience.
      - iforgotpassword 6y ago
        > But what about all of the innocent people who would be harmed by such a callous approach? They should then think again about their choice of using teams. Why should Microsoft rake in money from a shabby product while volunteers have to fix their shit? Assigning a ridiculously low score to significantly lower the bounty as a billion dollar company is disgusting.
        untog 6y ago
        > They should then think again about their choice of using teams. What percentage of Teams users do you think have a choice in their use of Teams?
        the8472 6y ago
        If it's on their work machines then it primarily endangers their employer's data, much less their own.
        airstrike 6y ago
        And then when the company loses business from the disruption, do you think employees walk away scot-free?
        the8472 6y ago
        I consider that inherent risk. Not getting a raise because the company made business decisions that turned out suboptimal (such as gaining short-term profits by not investing IT security) is a risk that any employee faces. If you want a more stable environment you go for a more risk-averse employer, perhaps even public sector jobs.
    - MrDresden 6y ago
      While I get your sentiment, I must disagree. Profiting from the very likely unethical use of the exploit would be unethical. Instead this mishandling by M$ should rather cause researchers to publicly announce the vulnerabilities which would hopefully cause M$ to change their ways in future dealings. It is ofcourse easy for me to say this, not being a researcher who lives off of the discoveries made.
      - krageon 6y ago
        Participating in a system that exploits researchers for free labour using societal guilt-tripping is the unethical move here. That means you.
        MrDresden 6y ago
        I see you completely missed my point. My point is that in the case of M$ the defects could be publicly announced to all parties at once as a way of making M$ realize that how bad their handling is/was. In all likelyhood this shouldn't have to happen for too long before they would realize their mistake. Many other corporations do indeed value the discoveries of researchers and do pay accordingly for being notified. Never did I suggest that this should become the industry norm (i.e not paying for private disclosures). Now what ever your personal feelings on that idea is, it does not change the fact that selling exploits to other parties would be unethical. Furthermore, participating in a system that promotes assumptions and flawed reading comprehension is not conductive to a good discourse. That means you.
    - rndgermandude 6y ago
      Thing is, we don't know if this was found before by malicious actors and sold and/or abused. This thing sounds like it is mostly pretty straight forward to find once you start looking - "you" being somebody experienced in this field of research, that is. At least you don't have to construct fancy weird machines (with type confusion, heap spraying and all those shenanigans). It comes down to finding something that can perform code execution in their internal API (here: "electronSafeIpc") and then finding a way to get there (here: angular escape bypass/not-properly-sanitized user provided data) and you can do both in javascript and don't have to read tons of machine code. Given that Teams is a great target because of it's large and often corporate user base, I'd be surprised if none of the usual industrial espionage suspects (e.g. China, NSA, etc) had a look at Teams before. And I'd think the chance of them having found the same bug, or a related bug, once they looked is pretty good too. From what I am hearing even the (US) military uses Teams sometimes... If that isn't incentive to look at this thing for "interested parties", then I don't know.
      - oskarsv 6y ago
        please check out how much code MS Teams actually has, before statements like this :) (it’s more than 30MB of compressed JS)
        rndgermandude 6y ago
        I didn't want to belittle your work, if you think that was the case. It's still outstanding to find things like that on your own, and a lot of work goes into it. Sorry if I gave the wrong impression. I have analyzed foreign code bases of similar dimensions in the past myself and found critical bugs. The size doesn't say much, it comes down to identifying the "interesting" bits (like the electronSafeRpc in this case), which can be hard and tedious, but greatly reduces the code you have to look at in detail. My assertion is that if your name is e.g. China then you will not be turned off by that.
        oskarsv 6y ago
        that electronSafeIpc API is actually not that interesting and a completely standard way to do things for ElectronJS apps. No, I do agree - from my perspective C/C++ class bugs are more difficult. Maybe they see this as magic as well. Still, it was painstaking work and in either case CountryX will easily surpass those difficulties.
    - SkyPuncher 6y ago
      "Locks can be picked so everyone should break into homes to proved a point" Lol, no.
      - the8472 6y ago
        That most locks are pickable is common knowledge and that is why high-risk targets invest in additional security beyond locks. That crufty electron apps are a security risk is not. So yes, you do need someone to run out into the streets and yell that the emperor has no clothes. Otherwise common knowledge will not be established.
    - Wowfunhappy 6y ago
      Aside from the harm this could inflict on innocent users, I’m not actually convinced it would cause vendors to change their behavior. From a business perspective, the reason exploits are bad for companies is because they generate bad press, right? Well, it's not obvious to me that an exploit which was being used in the wild gets significantly worse press than one which was not. There's also the possibility the buyer will reserve an exploit for super-targeted attacks, and the public won't find out at all until year later.
    - coldtea 6y ago
      Yeah, that will show 'em... Then people will move to some understuffed FOSS alternative with 5 people working part-time on it, with as severe bugs that nobody notices (remember Heartbleed and countless others?)...
      - higerordermap 6y ago
        Imagine thinking people move to FOSS alternatives. Imagine thinking PHBs at most companies even care about security.
    - stjohnswarts 6y ago
      you could be a grey hat if you averaged out one exploit turned in to the proper group to one exploit sold to the highest bidder. Flip a coin to be a real greyhat
    - mNovak 6y ago
      If the bounty money borders on insignificant, there's always public shaming. Demo the exploit in a controlled environment, and let the media cycle go.
      - rasz 6y ago
        why controlled? Last time some dude got frustrated and started dropping zero days pretty much weekly Microsoft finally hired him to make it stop.
    - 314 6y ago
      So the people / companies who would be hacked and have their data / systems destroyed are what? Acceptable collateral damage?
  - krageon 6y ago
    Not selling this is the real crime here. Microsoft's conduct in this case deserves much worse than just that. Hoping for a reward now is obviously not going to happen - the best you can hope for as a response to an act like this is legal action. In a vindictive way, you can definitely hope they will get significantly damaged by this and in that way learn their lesson, but I doubt it.
- csnover 6y ago
  Sorry if I am just obtuse but I don’t see a timeline in the linked report on GitHub. All I can see is that you tested against a version of Teams from 2020-08-31. Being able to see the complete timeline of communication with MS from discovery to public disclosure is not necessary but would give a more complete picture of how this went down, and I’d like to see it too if it’s not such a hassle.
  - oskarsv 6y ago
    There is no timeline besides when I reported it and now minus 2wks. They never told me when the fix was deployed. There is little value in going through the email chains to note each date:(. Final decision was made 2020-11-19
    - politelemon 6y ago
      Could you put that in the README, is what we're asking, as vague as it may be. At the moment the 'has been fixed' is the only clue to this in terms of resolution, and it's tucked away; without it it looks like most of the README is attempting to capitalize on the shock/outrage factor. Edit: Thanks, author has added some dates. https://github.com/oskarsve/ms-teams-rce/commit/35eac619fdef8015b70d8a7119965538daed8e05 https://github.com/oskarsve/ms-teams-rce/commit/35eac619fdef...

tclancy 6y ago

Is there any tell-tale sign this happened to you? I had a really weird experience on Mac last week: I opened up my machine and when I focused on teams I got a security alert saying something called Endgame from Elastico was demanding permissions. Never downloaded it but there it was in Applications.

oskarsv 6y ago
no, as you can see in the first demo it could be completely silent. not saying you are safe - I don’t know :)
eqvinox 6y ago
It is technically never possible to guarantee tell-tale signs of an RCE. At the point where you're running compromised code, that code could in most cases be constructed as to erase its own tracks. There might be some visible sign at the moment of exploitation, but after that it's kinda over. (Yes this assumes the RCE escalates to a reasonably high privilege, but that's just a matter of chaining. You can try to go for things like sealed logs, but ultimately arbitrary code can put your machine in an arbitrary state.) Particularly insidious for this would be the case of data theft. The RCE might load some code to upload your company secrets and keep itself strictly in RAM, and then erase itself when done. With enough blackhat craftiness you'd never be able to pinpoint the exact location of the leak.
gnfargbl 6y ago
Is this a work Mac? If so then it is likely managed through some kind of MDM system (JAMF etc), and it wouldn't be unreasonable for the owner of the hardware to be pushing down an endpoint agent like Elastic Endgame. Check in with your security team and ask them.
hundchenkatze 6y ago
If you're using an employer provided computer then they've likely installed Endgame[0] which is an endpoint (it runs on each device) security tool. Endgame was acquired by Elastic[1] last year [0] https://en.wikipedia.org/wiki/Endgame,_Inc https://en.wikipedia.org/wiki/Endgame,_Inc. [1] https://en.wikipedia.org/wiki/Elastic_NV https://en.wikipedia.org/wiki/Elastic_NV

thawab 6y ago

Have you been tempted to build a worm and click send? not to brake anything, just a text popup with an optimistic optimistic quote.

deleted 6y ago
[deleted]
oskarsv 6y ago
only as a thought exercise. the ability to 'switch off the internet' (115 million daily active big corp users) is tempting, but no, not really :)
- jojobas 6y ago
  That's one way to force them to not make bug like that "important, spoofing" and "out of scope".
throwaway201103 6y ago
Google Robert Morris to find out how that goes.
- thawab 6y ago
  From his wikipedia: He is a longtime friend and collaborator of Paul Graham. Graham dedicated his book ANSI Common Lisp to Morris. Graham lists Morris as one of his personal heroes, saying "he's never wrong." to be friends with Paul Graham, i should make a worm. Got it.
  - xyzzy123 6y ago
    Ehh in 1988 that worm was like an alien artifact from the cyberpunk future. First "real" worm code, multi-platform, multiple payloads, "staging", first practical buffer overflow exploit and it does credential brute-forcing. Heck it was not until nearly a decade later that people were really doing buffer overflows, and there were a LOT of easy overflows to be found. I'd make the case rtm didn't just "make a worm" he foreshadowed the next few decades of computer exploitation. Took a whole bunch of research and ideas, synthesised them, built an actual working "product" a decade or two ahead of its time and released it in a transgressive way. If you are the kind of person who can do that I'm sure lots of people would like to be friends with you.

ROARosen 6y ago

There is, however, some consolation in the fact that only an individual who is already connected to you in Teams can run this. That's not to say - of course - it's not abuse-able, it just gives some context to the fact threat MS calls this "Spoofing", since presumably, your Teams contact is someone you trust. So the bad actor is "spoofing" as someone trustable within your org (or outside it). But is does prob need some social-engineering for a bad actor to truly exploit this. But the threat is still sever since the above logic only holds up to the point-of-entry, once the worm has infected someone the people forwarding it around are truly trusted.

csnover 6y ago
One of my health care providers use Microsoft Teams as their telehealth solution. My city government uses Microsoft Teams for some public meetings. The idea that folks are only using Teams to connect with other trusted parties is comforting, but false.
- noir_lord 6y ago
  > Microsoft Teams as their telehealth solution That sounds..interesting. I suspect with the on-going pandemic lots of tools are getting used in interesting ways they where never really designed for just to keep things going.
  - csnover 6y ago
    It’s bad, but it’s mostly bad because Teams is bad. It’s still better than Amwell, which somehow manages to have multi-second latencies and requires me to manually mute my video preview to stop it looping back my own audio. The old P2P Skype had better video quality and latency, even when talking to people 4000 miles away, than every video product I’ve used in the last year. Probably not coincidentally, every video product I’ve used in the last year has been web-based. WebRTC is an enormous disappointment.
  - kritiko 6y ago
    Microsoft advertises Teams for telehealth: https://www.microsoft.com/en-us/microsoft-365/microsoft-teams/healthcare-solutions https://www.microsoft.com/en-us/microsoft-365/microsoft-team...

jacquesm 6y ago

Thank you for making the internet slightly better.

edwintorok 6y ago

Could you clarify the "one of five" statement please? Are the other 4 vulnerabilities still unfixed, or they are fixed but a write-up is still pending? If there are still 4 unfixed RCE bugs in Teams I'd rather people uninstall Teams than wait for the fix...

draugadrotten 6y ago
It would be safest to assume that you have at least one unfixed RCE bug in Team, even if oskar did not discover it yet.

jeltz 6y ago

Maybe I missed it but I do not understand why injecting a null byte allowed you to bypass Angukar's protections. Is that a bug in Angular and if do is it fixed?