The Microsoft Teams vulnerability shows the danger of collaboration apps

Couldn’t attend Transform 2022? View all summit sessions in our on-demand library now! Watch here.

Microsoft Teams is probably the largest enterprise communication platform in the world. It rose to prominence during the COVID-19 pandemic as a key space for business users to maintain productivity.

Teams has over 270 million monthly active users. The pandemic helped accelerate the platform’s reach from 75 million users in April 2020 to 115 million in October 2020 and 145 million in April 2021.

Overall, Gartner recorded a 44% increase in employee use of collaboration tools from 2019, to the point where 80% of workers were using collaboration tools for work in 2021.

While these tools are convenient, their widespread use has opened the door to some serious vulnerabilities.


MetaBeat 2022

MetaBeat will bring together thought leaders to provide guidance on how metaverse technology will transform the way all industries communicate and do business on October 4 in San Francisco, California.

Register here

For example, according to research released yesterday by Vectra, the Windows, Mac, and Linux versions of Teams store authentication tokens in plain text on the underlying device. This is important because it means that if an attacker hacks into a system where groups are installed, they can gain access to authentication tokens along with other information.

This vulnerability highlights that enterprises cannot afford to rely on the security of public consumer-grade communication platforms when communicating sensitive information, IP and other data.

How bad is the Microsoft Teams vulnerability?

It’s not the first time collaboration tools like Teams have come under fire for insecurity. At the beginning of this year, Avanan detected a significant increase in cyberattacks taking place on Microsoft Teams, with threat actors using chats and channels to circulate malicious .exe files.

These new vulnerabilities are another chink in the armor of apps that aim to be enterprise-grade communication platforms.

“In essence, that’s still it [the] solved the problem of cookies and other web credentials being stolen by attackers with local access,” said John Bambenek, principal threat hunter at Netenrich. “That doesn’t mean it’s not important. The fundamental problem is that attackers can steal a cookie and use it on any number of machines to recreate an authenticated machine.”

“I would like to see developers and tech companies send these credentials hashed with some local machine specific information so that the cookie and credential attackers are completely gone,” Bambenek added.

The problem with collaboration apps

Collaboration apps are not immune to vulnerabilities. Like any browser-based software, they have inherent bugs and can be targeted by web-based attacks and phishing attempts.

It was just recently revealed that a bug in Slack had exposed the hashed passwords of some users over a period of five years. This comes about a year after attackers used stolen cookies to hack EA Games’ personal communication channel, allegedly stealing 780GB of data, including Fifa 21’s source code.

The problem isn’t that solutions like Slack or Microsoft are particularly weak, but that they aren’t optimized to keep up with the level of sophisticated threats targeting modern organizations from both cybercriminals and government agencies.

Despite these weaknesses, many organizations continue to share protected information through these channels. According to Veritas Technologies, 71% of office workers worldwide admit to sharing sensitive and business-critical company data using virtual collaboration tools. So what can organizations do?

Limiting the risk of collaboration applications

Vectra reported the new Teams vulnerability to Microsoft in August, but the latter disagreed that the severity of the vulnerability warranted a patch.

In any case, businesses that process and manage trade secrets or regulated information should be cautious about using communication applications that put high-value data at risk of exposure. This does not mean that they should stop using communication apps altogether. But that means they will have to implement strong controls to reduce the risk of data leakage.

As a Deloitte report notes, “Collaboration technologies, while vital during the rise of virtual work, can pose serious threats to organizational security and privacy if not managed properly. As these technologies expand their reach and prevalence in business operations, organizations will need to monitor potential threats, establish controls where possible and promote service availability.”

In practice, controls include using selected strong randomized passwords, using Cloud Security Broker (CASB) solutions to detect data intrusion, implementing content guidelines for platforms, and deploying a web application firewall to detect layer attacks application.

VentureBeat’s mission is set to be a digital town square for technical decision makers to learn about and transact business-transformative technology. Discover our Updates.

Leave a Comment