27 C
Jaipur
Saturday, October 24, 2020

Hackers Abuse Microsoft Teams Updater to Install Malware Using Living off the Land Technique

Must read

The ‘Bittle’ Is a Tiny Version of the Boston Dynamics Robot-Dog

With more and more development in robotics, we have seen developers build some really advanced robots to aid humans in various tasks. We have all...

Maharashtra Government invites Tesla to set up a local plant | TechRadar

Elon Musk recently talked about how Tesla would come to India in 2021. While that could have many meanings, local governments are now taking...

VPN’s coming-of-age: A discussion with the ExpressVPN co-founders

It feels like VPNs are suddenly everywhere. What was once a technology used only by IT professionals and large businesses has now become a...

World Series live stream 2020: how to watch Dodgers vs Rays game 3 anywhere now

In a matter of days, the year's shortened MLB season will crown a new champion, but who will it be? The 2020 World Series...

Microsoft Teams Updater

A new flaw with Microsoft Teams Updater allows attackers to install and run malware from a remote location Using Living off the Land Technique.

The issue was first disclosed last year and it relies on using the ‘update’ command to run the arbitrary binary code with the context of the current user.

Microsoft Teams Updater Flaw

The flaw discovered earlier by reverse engineer Reegun Richard in 2019, he revisited the problem this year with the solution implemented by Microsoft.

“The patch previously provided for Teams was to restrict its ability to update via a URL. Instead, the updater allows local connections via a share or local folder for product updates” – Reegun Jayapaul from Trustwave said.

He found that the patch can be easily bypassed by pointing to a remote SMB share and it can be used for lateral movement.

With the last patch of the Microsoft Teams update it allows only local network paths server to access and update and blocks the “http/s”, “:”, “/” and port numbers in the updater URL.

How an Attacker can Exploit this

Attackers need to place the file inside the network in an open shared folder. Then the attackers need to access the payload from that share to the victim machine.

Attackers also can exploit the bug remotely by setting up a Samba server for remote public access, and by initiating the command execution a payload can be downloaded remotely and executed directly from Microsoft Teams Updater “Update.exe”.

Steps to create payload, requirements and technical details can be found here, Trustwave has reported the issue to Microsoft.

Microsoft said that “Thank you again for submitting this issue to Microsoft. We determined that this behavior is considered to be by design as “we cannot restrict SMB source for –update because we have customers that rely on this (e.g. folder redirection).”

Trustwave recommends SMB connections especially from the Microsoft Teams updater update.exe or filters SMB connections entirely.

A lot of businesses have transitioned to a remote workforce due to the current health crisis. To protect your business and your remote teams here are some of the best practices.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Hackers Hijack Microsoft Teams Accounts Using a Single Weaponized GIF Image

Beware of Fake Microsoft Teams Notifications Aimed to Steal Employees Passwords

Source link

- Advertisement -

More articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest article

The ‘Bittle’ Is a Tiny Version of the Boston Dynamics Robot-Dog

With more and more development in robotics, we have seen developers build some really advanced robots to aid humans in various tasks. We have all...

Maharashtra Government invites Tesla to set up a local plant | TechRadar

Elon Musk recently talked about how Tesla would come to India in 2021. While that could have many meanings, local governments are now taking...

VPN’s coming-of-age: A discussion with the ExpressVPN co-founders

It feels like VPNs are suddenly everywhere. What was once a technology used only by IT professionals and large businesses has now become a...

World Series live stream 2020: how to watch Dodgers vs Rays game 3 anywhere now

In a matter of days, the year's shortened MLB season will crown a new champion, but who will it be? The 2020 World Series...

Skype is back, and wants to take on Zoom

The pandemic has seen demand for video conferencing software skyrocket as businesses use the technology to work from home and students use it for...