Accessing Microsoft Teams using organizational or personal credentials
This should have been fixed in January. I'm a pentester.
Mitigation is necessary before posting any steps to reproduce here.
Hello Microsoft,
Do you not pay attention to your own forums? Ok, Let's do this publicly:
Steps to reproduce:
- Launch and login to Teams personal and enterprise. Dual screens preferred.
- Turn off Wi-Fi
- Pull the Ethernet cable.
- Grab some coffee.
- Observe the difference in error messages.
You can probably search the code for the error message verbatim.
This could be a request from your IT department or Teams, or the result of a password update.
Why this has been so elusive to Microsoft is a much more interesting story, but makes sense. Really smart people never use Wi-Fi if we can avoid it, but that's also the root of the problem. Geeks are wired, so we never see this error message. It doesn't help the error message is completely wrong. It should be "We freaked out at losing the internet for a millisecond or two, so enjoy this lovely popup!"
When connected to the internet, clicking "Sign In" makes the banner disappear. This is why this bug was so elusive. Unless you're a pentester, the problem resolves itself.
The problem is resolved in the consumer or Personal version of Teams. It's likely a minor oversight or a configuration issue this wasn't pushed to all versions of Teams. Fix Enterprise first ;)
The changes on the Personal Teams made this simple to diagnose, but that requires those same geeks to have both versions installed. Microsoft clearly missed an internal pentest here, or this never would have made it into production.
Everyone has seen this error, and just ignores it. Switching Access Points (APs) causes the same issue for the banner to immediately pop back up. This is why traveling professionals have been frustrated for so long. It's painfully obvious to everyone that's _not_ hardwired.
If you want to get into Cybersecurity, start here.
Synopsys https://www.linkedin.com/company/synopsys/
Black Duck https://www.linkedin.com/company/black-duck-software/
Cheers,
Ritchey