Microsoft Teams: Blocking and unblocking

A weakness has been highlighted to Microsoft recently, where malicious files can be sent directly to a Teams user that is not part of their tenant.

By default Microsoft Teams is set to allow you to communicate with an external contact, but does not allow for the delivery of files. However a US cybersecurity team have found a way to bypass this and released a tool to allow others to do this. Which means that files can be sent directly to a Teams chat. The risk is that you could download malicious content that could be used to breach your organisations systems.

What can you do? 

Annoyingly, as Microsoft have no fix date set. There are only two mitigations:

1. Disable all external communications in Microsoft Teams.
2. Increase user awareness.

The first option is not a great solution for productivity, collaboration or communication.

As always awareness is the best defence against the criminals. Here are three markers to look for that tells you that the individual is not part of your organisation.

1. Every external chat has “External” set at the top.
2. A message will show that a contact is part of an organisation. It’s not the best message, but internal contacts won’t display this.
3. Every chat from an external contact will have, Their name (External), above the message.

If you do receive an unexpected link or file from an external contact, DO NOT click on the link or download it. If this is someone you do know, reach out to them via a separate method to confirm this was intentional.

If this isn’t a contact you are familiar with, block them (watch the video above to find out how) in the first instance and let your IT team know.