Tuesday, March 19, 2024

Hackers Abuse Microsoft Teams Updater to Install Malware Using Living off the Land Technique

A new flaw with Microsoft Teams Updater allows attackers to install and run malware from a remote location Using Living off the Land Technique.

The issue was first disclosed last year and it relies on using the ‘update’ command to run the arbitrary binary code with the context of the current user.

Microsoft Teams Updater Flaw

The flaw discovered earlier by reverse engineer Reegun Richard in 2019, he revisited the problem this year with the solution implemented by Microsoft.

“The patch previously provided for Teams was to restrict its ability to update via a URL. Instead, the updater allows local connections via a share or local folder for product updates” – Reegun Jayapaul from Trustwave said.

He found that the patch can be easily bypassed by pointing to a remote SMB share and it can be used for lateral movement.

With the last patch of the Microsoft Teams update it allows only local network paths \server\ to access and update and blocks the “http/s”, “:”, “/” and port numbers in the updater URL.

How an Attacker can Exploit this

Attackers need to place the file inside the network in an open shared folder. Then the attackers need to access the payload from that share to the victim machine.

Attackers also can exploit the bug remotely by setting up a Samba server for remote public access, and by initiating the command execution a payload can be downloaded remotely and executed directly from Microsoft Teams Updater “Update.exe”.

Steps to create payload, requirements and technical details can be found here, Trustwave has reported the issue to Microsoft.

Microsoft said that “Thank you again for submitting this issue to Microsoft. We determined that this behavior is considered to be by design as “we cannot restrict SMB source for –update because we have customers that rely on this (e.g. folder redirection).”

Trustwave recommends SMB connections especially from the Microsoft Teams updater update.exe or filters SMB connections entirely.

A lot of businesses have transitioned to a remote workforce due to the current health crisis. To protect your business and your remote teams here are some of the best practices.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Hackers Hijack Microsoft Teams Accounts Using a Single Weaponized GIF Image

Beware of Fake Microsoft Teams Notifications Aimed to Steal Employees Passwords

Website

Latest articles

Researchers Hack AI Assistants Using ASCII Art

Large language models (LLMs) are vulnerable to attacks, leveraging their inability to recognize prompts...

Microsoft Deprecate 1024-bit RSA Encryption Keys in Windows

Microsoft has announced an important update for Windows users worldwide in a continuous effort...

Beware Of Free wedding Invite WhatsApp Scam That Steal Sensitive Data

The ongoing "free wedding invite" scam is one of several innovative campaigns aimed at...

Hackers Using Weaponized SVG Files in Cyber Attacks

Cybercriminals have repurposed Scalable Vector Graphics (SVG) files to deliver malware, a technique that...

New Acoustic Keyboard Side Channel Attack Let Attackers Steal Sensitive Data

In recent years, personal data security has surged in importance due to digital device...

Discontinued WordPress Plugin Flaw Exposes Websites to Cyber Attacks

A critical vulnerability was discovered in two plugins developed by miniOrange.The affected plugins,...

ShadowSyndicate Hackers Exploiting Aiohttp Vulnerability To Access Sensitive Data

A new Aiohttp vulnerability has been discovered, which the threat actor ShadowSyndicate exploits.Aiohttp...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles