How Safe is Microsoft Teams? Understanding the New Vulnerability Vectra Uncovered

Key Points in This Article

• Cybersecurity researchers at Vectra recently unearthed a new vulnerability in Microsoft Teams that may allow cyber criminals the means to cause considerable harm.
• The vulnerability requires cybercriminals to already have a certain level of access to your network or device.
• Rather than asking what you should do about Teams in light of this vulnerability, you should take every possible precaution and measure to keep your access credentials secure.

It’s a foregone conclusion these days that no matter what software application significant players like Microsoft roll out or security updates they provide, a new vulnerability will invariably be discovered. After all, a veritable army of hackers, cybercriminals, and even nation-state actors work continuously to identify these vulnerabilities for their own purposes. And these threat actors often think in creative ways that corporations are designed to, allowing them to find weaknesses that even experienced cybersecurity professionals overlook.

Understanding Software Application Vulnerabilities

When a software vulnerability is found in an application at a company like Microsoft, Apple, or Google, it quickly makes headlines in not just industry publications but also mainstream media. However, those working in cybersecurity know that such vulnerabilities are pretty common and that not all vulnerabilities pose the same level of risk. Nevertheless, those outside the field often quickly question whether widely used software is safe or whether it should be quickly discarded in favor of a new, unidentified, yet presumed safer measure.

Microsoft Teams recently made some headlines when cybersecurity researchers at Vectra unearthed a new vulnerability in the application. And because of the headlines, it’s likely some business leaders may have found themselves asking their CIOs and IT directors whether Teams was still safe to use.

When such headlines occur, influential IT professionals likely have taken the time to understand the nature of this vulnerability and assess the risks it may pose before making recommendations or taking action. Doing so can help save them from acting precipitously by spending time and money moving to a competing software without determining if a simple patch or other safety measures might eliminate the risk.

So what is the nature of the vulnerability? How much of a risk does it pose? And is Microsoft Teams still safe for businesses like yours to use?

The Microsoft Teams’ Vulnerability Vectra Uncovered

Vectra researchers realized that the Teams holds user authentication tokens in plain text on their desktop devices. When you install and use the Microsoft Teams client on Windows, Mac, or Linux, those credentials can be found on your device even when Teams is closed. A hacker or cybercriminal who has access to your system could use these credentials to access Teams, Outlook, and SharePoint, among other applications, modify files, steal data, and compromise your security.

Moreover, these credentials allow a hacker to take any action you might through the Team interface, bypassing the need for multi-factor authentication. For example, a cybercriminal who accesses the account of a C-suite leader through this Teams’ vulnerability could hijack their Outlook account and steal proprietary information from the business leader’s email account or SharePoint document library.

Cybercriminals could also use their newfound access credentials to send phishing emails to employees throughout the organization. These phishing efforts, coming from the email account of a company leader, could be designed to encourage employees to take actions that further compromise network security, such as downloading malware or ransomware. These are just two possibilities. An enterprising cybercriminal could easily cripple a business or organization in many other ways.

Vectra initially discovered this vulnerability after one of its customers noted that Teams users cannot remove deactivated accounts through the Teams UT when their user account is disabled. Vectra began investigating and learned that Teams’ storage of user credentials was not secure. The company shared its discovery of the vulnerability with Microsoft in August 2022. Perhaps surprising to some, Microsoft did not immediately set about patching this exploit. They confirmed that it could pose a threat and indicated they would address it in a future Teams update.

What Relative Risk Does This Vulnerability Pose?

This response may seem to downplay the possible risk and strike some as cavalier. But while this vulnerability allows cybercriminals with only read access to your system to gain your Teams credentials, the truth is if a cybercriminal gains access to an employee’s account, there are many other ways they can leverage that access at the expense of the business or organization. And it remains incumbent on employees in every department (not just IT) to ensure that authentication credentials don’t fall into the wrong hands.

Businesses and organizations must provide their employees with regular, practical, and current cybersecurity awareness training to ensure that all employees do their part to protect their employers. Employees must understand how to identify and report suspicious activity they encounter, take steps to secure their devices, and avoid downloading applications that could house malware and viruses. They must understand and follow their employer’s cyber security policies without fail to keep their account credentials out of the hands of third parties.

CIOs and IT professionals must develop, maintain, and refine strong cybersecurity policies that cover the entirety of the organization. And they must ensure that all areas comply and that no shortcuts are taken. That means eliminating legacy practices like granting certain users local admin privileges to cut down on help desk requests. It also means continuously testing existing measures to pinpoint vulnerabilities before third parties. A single exploit left unidentified and unaddressed can prove catastrophic. One recent study holds that the average cyberattack costs a company $200,000, which can be enough to put a small business out of business.

So, while Microsoft’s response may seem to downplay the risk, businesses and organizations most at risk from this vulnerability are those with poor fundamental cybersecurity measures in place already. And while business and IT leaders should be aware of this vulnerability, it does not make Microsoft Teams more unsafe to use. Those who are concerned about it should take every available measure to protect their network and device access credentials from falling into the wrong hands before giving any thought to switching platforms. Because no matter which platform you select, if a cybercriminal obtains usernames and passwords, everything is vulnerable.