We could have pwned Microsoft Teams with a GIF, claims Israeli infosec outfit A vulnerability existed in Microsoft's Slack for Suits tool, Teams, that could have let a remote attacker take over accounts by simply sending a malicious GIF, infosec researchers claim. The pwn-with-GIF vuln was possible, said Cyberark, thanks to two compromisable Microsoft subdomains along with a carefully crafted animated …
The whole process sounds rather simple to set up, but it's not exactly simple to execute - unless Teams automatically loads an image when sent a link.
Given that this is Microsoft we're talking about, that seems more than likely. Still, you have to be able to send the person a link. That means that you have to have the Teams user name or something like that. How easy is that to get if you're not in the company Teams list ?
Full disclosure : I don't use Teams, as you might have guessed.
@Captain Scarlet : "Scooby Doo and Garfield"
When I used to use an instant messenger service to communicate with a colleague, our two favourite animated .gifs were tumbleweed and a bunny banging it's head against a wall. I don't think I need to explain either : -)
"After doing all of this, the attacker can steal the victim's Teams account data"
Quite often that is their AD user account and password thanks to the convenient hookup between AD and Azure. There are rather a lot of hastily cobbled together remote desktops and so on around the world right now.
Your point is well taken about the limitations on sending random messages; that said, there does appear to be a way to grant guest access to Microsoft Teams to folks using their email addresses:
https://docs.microsoft.com/en-us/microsoftteams/communicate-with-users-from-other-organizations
So, theoretically, imagine if someone were able to add themselves to Teams using an external address without admin intervention or approval. Again, possibly limited usefulness in and of itself. Cobbled together, however, might open the door for exactly this type of malicious message vulnerability.
It should really read "no online collaboration platforms are even near secure"
Zoom routes everything via China, how convinient. "crypted" but not really.
Teams routes everything, including private messages, via Redmont. Unencrypted of course.
Pieces of BS spyware. Or 'collaboration'with US and Chinese authorities, spiced with Microsoft.
So who's actually surprised? It's just Windows after all, we know that security has never been an issue for Microsoft, they are too busy adding new features and collecting data to worry about security.
Downvote this post if you believe that Microsoft cares more about security than collecting your data.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
