Login

Register

Login

Register

#microsoft | #microsoftsecurity | Microsoft Teams fixes a security vulnerability that exploited GIFs to access a user’s data – | #cybersecurity | #informationsecurity


Apps like Microsoft Teams have seen a steady rise in popularity courtesy of the COVID-19 pandemic and the resultant social distancing. But they’ve had their fair share of privacy concerns too. Last month, security researchers at CyberArk uncovered a flaw in Microsoft Teams (desktop and web browser version both) that put an account and the associated computer’s data at risk with the help of a GIF.

Succinctly, all the user had to do was view a specific GIF that they had received. Once this was done, in the background, a hacker could use a compromised subdomain to steal security tokens and mine the victim’s data.

Concretely, the malicious GIF enclosed an ‘src’ attribute. When it was opened, the target browser would try to load the GIF and this would send the ‘authtoken’ cookie, which is used to authenticate the loading of images in domains across Skype and Teams, to the compromised sub-domain. This meant that the attacker would get their hands on the victim’s authtoken, allowing them to carve a pathway to scrape the victim’s data.

The bug was reported to Microsoft on March 23, but the issue has now been fixed in a recent update. CyberArk stated that it worked on the vulnerability with Microsoft Security Research Center under Coordinated Vulnerability Disclosure. So far, there is no evidence that suggests that the bug was exploited by cybercriminals.

Source link

______________________________________________________________________________________________

Get your CompTIA A+, Network+ White Hat-Hacker, Certified Web Intelligence Analyst and more starting at $35 a month. Click here for more details.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .





Source link
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Leave a Reply

Shqip Shqip አማርኛ አማርኛ العربية العربية English English Français Français Deutsch Deutsch Português Português Русский Русский Español Español

National Cyber Security Consulting App

 https://apps.apple.com/us/app/id1521390354

https://play.google.com/store/apps/details?id=nationalcybersecuritycom.wpapp


NATIONAL CYBER SECURITY RADIO
HACKER FOR HIRE MURDERS
 

ALEXA “OPEN NATIONAL CYBER SECURITY RADIO”

National Cyber Security Radio (Podcast) is now available for Alexa.  If you don't have an Alexa device, you can download the Alexa App for free for Google and Apple devices.   

nationalcybersecurity.com

FREE
VIEW