Zero-click, wormable, cross-platform remote code execution in Microsoft Teams

Re:Zero-click, wormable, cross-platform remote code executio... by coldtea on Monday December 07, 2020 @12:48PM (#25334672)

>‼ That's it. There is no further interaction from the victim. Now your company's internal network, personal documents, O365 documents/mail/notes, secret chats are fully compromised. Think about it. One message, one channel, no interaction. Everyone gets exploited.

Yeah, so? He makes it sound like some novel nightmare, but that has been the case with 0-day, RCE bugs for half a century, and we have had tons of those...

[ Parent | on HN ]

Re:Zero-click, wormable, cross-platform remote code executio... by scinerio on Monday December 07, 2020 @01:31PM (#25335339)

I mean, the impact varies per organization but can be pretty severe in certain contexts. I'm considering the fact that many organizations have the majority of their proprietary data living on things like Sharepoint, OneDrive, and so on (as opposed to sparse data stored locally).

I would consider this a bit more unique.

[ Parent | on HN ]