Research by Shai Alfasi and Marlon Fabiano da Silva with the CySource research team. Originally published on cysrc.com in 2022.
In this research, Shai Alfasi and Marlon Fabiano da Silva, together with the CySource research team, discovered that they could gain control of a Microsoft SMS mechanism and send any SMS message they wanted on behalf of Microsoft.
In addition to being able to edit the content of the message sent via SMS, we were able to make voice calls and edit the phrases the bot would speak to the victim.
Description
At the identity-confirmation step, before redeeming a reward on rewards.microsoft.com, the user could enter any phone number to receive the 2FA code. The application did not verify that the logged-in user actually owned that number.
It was also possible to change the content of the message. The original text, Your Microsoft Rewards Confirmation Code is XXXXX, could be replaced with something like:
Your Microsoft account has been hacked. We will contact you to validate your data.
A message like this could have been used to deceive Microsoft users into sharing personal data or opening malicious links.
The researchers also noticed that there was no limit on the calls or SMS messages sent. By automatically repeating the same request, it was possible to send 1,000 SMS messages and make 200 calls. The weakness could therefore also have been used for denial-of-service attacks that flood Microsoft customers’ phones.
Steps to reproduce
- Open Microsoft Rewards and sign in with a Microsoft account (MSA).
- The signed-in account must have points available to redeem.
- Click any offer to redeem it. You are asked to confirm your identity through 2FA.
- Intercept the request with a proxy. The same request can be repeated to abuse the missing rate limit, and both the phone number the calls and messages go to and the content of the messages can be changed (for scam and phishing attacks).
- With an automated tool, the vulnerability could be used to run spoofing attacks through Microsoft’s infrastructure to steal Microsoft customers’ data.
The impact of such a vulnerability
In addition to the financial loss for Microsoft, an attacker could have used the 2FA mechanism to send phishing SMS messages or make phishing calls to Microsoft’s employees, customers and partners.
After we approached Microsoft with this report and a proof of concept, the vulnerability was quickly fixed.