Mutt
Professional
- Messages
- 1,458
- Reaction score
- 1,070
- Points
- 113
Ever wondered how meeting invitations work in Microsoft Teams and Google Meet? Recently, I was working on a social engineering issue, and a random thought occurred to me: how do meeting invitations actually work, can they somehow be used in fraudulent schemes?
Yes, such a thought has already been discussed before, and this method has already been used. But no one has ever explained how it works. I have not been able to find a single blog that technically describes this attack. Therefore, I decided to delve into it myself, in order to tell in human language to everyone who is interested in penetration tests and security issues in general.
What did I want to do in this attack?
Send a fake meeting invitation, creating a sense of urgency so that the victim does not try to figure out the issue, but simply follows my link asking for credentials.
Appointment creation (in Outlook) usually works like this:
Create an appointment in Outlook
This is what a meeting invitation looks like
What's wrong with this invitation?
When you create a meeting invitation, you are actually sending a regular email with an iCalendar file attached. Depending on the recipient's email client and how that client handles iCalendar, you might see a nice email or a simple email with an attachment. Below you can see what the team meeting request looks like in protonmail.
What is an iCalendar object?
According to Wikipedia:
“The universal iCalendar format allows users to store and share their calendar and schedule information (eg, events, tasks, free / busy information). The iCalendar file is saved in text format and contains an event or task; used to send events or tasks to other users who can import them into their calendars. Typically .ics extension .
iCalendar is supported by Outlook, Google Calendar, Yahoo, Apple and many more. In this article, I will focus on Outlook.
Below you can see my version of iCalendar for a group meeting invitation. I just sent a meeting invitation to my protonmail address, downloaded it and read the attachment.
The thing to understand here is that every iCalendar object starts with BEGIN: VCALENDARand ends with END: VCALENDAR. The meeting part is between BEGIN: VEVENTand END: VEVENT. Within your event, you specify the so-called components. Usually not all components are required and in my POC you can find a stripped-down * .ics file with only the required components. Most of them are self-explanatory, but I will highlight the most interesting ones.
ORGANIZER. Specifies the name and email address of the meeting organizer. You can enter any email and name here to make it appear that the meeting request is from that person.
ATTENDEE. Indicates meeting attendees. If you need many members, you will have multiple ATTENDEE components. Be aware that attendees will not receive a meeting invitation email, it is for display only. You can easily simulate 30 people attending a meeting if you are actually sending an email to one victim.
X-MICROSOFT-SKYPETEAMSMEETINGURL.E If you specify this component will display the button "Connect" to be reminded of the meeting. Unfortunately, when clicked, the system will try to open the specified URL through the desktop app, resulting in an error.
DTSTART, DTSTAMP, DTEND. Indicate the time of the meeting and its duration. I did a clever trick and set the meeting start time 5 minutes earlier than the current time, so it feels like you were 5 minutes late for the meeting. When the victim receives an email, Outlook treats it as a meeting invitation. Sees that the meeting started 5 minutes ago and immediately displays a reminder on the screen. This helps simulate urgency.
How many people do you think would click on a link in the middle of the day when they saw they were late for a meeting?
In this article, I showed you how Outlook handles meeting requests. This should work with any email provider / client that handles *.ics attachments. You can check my POC on github and edit the script and templates to suit your needs.
Yes, such a thought has already been discussed before, and this method has already been used. But no one has ever explained how it works. I have not been able to find a single blog that technically describes this attack. Therefore, I decided to delve into it myself, in order to tell in human language to everyone who is interested in penetration tests and security issues in general.
What did I want to do in this attack?
Send a fake meeting invitation, creating a sense of urgency so that the victim does not try to figure out the issue, but simply follows my link asking for credentials.
Appointment creation (in Outlook) usually works like this:
- click the New Appointment button, which will open a page with email fields, pre-filled team template and meeting URL
- set the name of the meeting and specify the participants
- Click Send and your attendees will receive a beautiful email that allows them to accept or decline the meeting request.
Create an appointment in Outlook
This is what a meeting invitation looks like
What's wrong with this invitation?
When you create a meeting invitation, you are actually sending a regular email with an iCalendar file attached. Depending on the recipient's email client and how that client handles iCalendar, you might see a nice email or a simple email with an attachment. Below you can see what the team meeting request looks like in protonmail.
What is an iCalendar object?
According to Wikipedia:
“The universal iCalendar format allows users to store and share their calendar and schedule information (eg, events, tasks, free / busy information). The iCalendar file is saved in text format and contains an event or task; used to send events or tasks to other users who can import them into their calendars. Typically .ics extension .
iCalendar is supported by Outlook, Google Calendar, Yahoo, Apple and many more. In this article, I will focus on Outlook.
Below you can see my version of iCalendar for a group meeting invitation. I just sent a meeting invitation to my protonmail address, downloaded it and read the attachment.
Code:
BEGIN: VCALENDAR
METHOD: REQUEST
PRODID: Microsoft Exchange Server 2010
VERSION: 2.0
BEGIN: VTIMEZONE
TZID: GTB Standard Time
BEGIN: STANDARD
DTSTART: 16010101T040000
TZOFFSETFROM: +0300
TZOFFSETTO: +0200
RRULE: FREQ = YEARLY; INTERVAL = 1; BYDAY = -1SU; BYMONTH = 10
END: STANDARD
BEGIN: DAYLIGHT
DTSTART: 16010101T030000
TZOFFSETFROM: +0200
TZOFFSETTO: +0300
RRULE: FREQ = YEARLY; INTERVAL = 1; BYDAY = -1SU; BYMONTH = 3
END: DAYLIGHT
END: VTIMEZONE
BEGIN: VEVENT
ORGANIZER; CN = ExAndroid Developer: mailto: <redacted> @ outlook.com
ATTENDEE; ROLE = REQ-PARTICIPANT; PARTSTAT = NEEDS-ACTION; RSVP = TRUE; CN = <redacted> @ protonmail.com: mailto: <redacted> @ protonmail.com
DESCRIPTION; LANGUAGE = en-US: <stripped> \ n \ n
UID: 040000008200E00074C5B7101A82E00800000000508CC0468E28D701000000000000000
01000000096DF011F20A29943A70B5DA5047021A5
SUMMARY; LANGUAGE = en-US: Test meeting
DTSTART; TZID = GTB Standard Time: 20210403T000000
DTEND; TZID = GTB Standard Time: 20210404T000000
CLASS: PUBLIC
PRIORITY: 5
DTSTAMP: 20210403T103619Z
TRANSP: OPAQUE
STATUS: CONFIRMED
SEQUENCE: 0
LOCATION; LANGUAGE = en-US: Microsoft Teams Meeting
X-MICROSOFT-CDO-APPT-SEQUENCE: 0
X-MICROSOFT-CDO-OWNERAPPTID: -570210331
X-MICROSOFT-CDO-BUSYSTATUS: TENTATIVE
X-MICROSOFT-CDO-INTENDEDSTATUS: BUSY
X-MICROSOFT-CDO-ALLDAYEVENT: FALSE
X-MICROSOFT-CDO-IMPORTANCE: 1
X-MICROSOFT-CDO-INSTTYPE: 0
X-MICROSOFT-SKYPETEAMSMEETINGURL: https: //teams.microsoft.com/l/meetup-join/
19% 3ameeting_YmM1MjRmMTktYjA2N <stripped> cd8% 22% 7d
X-MICROSOFT-SCHEDULINGSERVICEUPDATEURL: https: //api.scheduler.teams.microsof
t.com/teams/dc<stripped>DAyMmZj@thread.v2/0
X-MICROSOFT-SKYPETEAMSPROPERTIES: {"cid": "19: meeting_YmM1MjRmMTktYjA2Ny00YWQ
4LWI1NWEtZmE1NGVlMDAyMmZj@thread.v2 "\," private ": true \," type ": 0 \," mid ": 0 \,"
rid ": 0 \," uid ": null}
X-MICROSOFT-ONLINEMEETINGCONFLINK: conf: sip: <redacted> \; gruu \; opaque =
app: conf: focus: id: teams: 2: 0! 19: meeting_YmM1MjRmMTktYjA2Ny00YWQ4LWI1NWEtZmE
1NGVlMDAyMmZj-thread.v2! 56474ffc245241c5ab4081a127cc1cd8! Dcf23acb18fc41d28
6acf752f1ca658d
X-MICROSOFT-DONOTFORWARDMEETING: FALSE
X-MICROSOFT-DISALLOW-COUNTER: FALSE
X-MICROSOFT-LOCATIONS: [{"DisplayName": "Microsoft Teams Meeting" \, "Loca
tionAnnotation ":" "\," LocationSource ": 0 \," Unresolved ": false \," Loca
tionUri ":" "}]
BEGIN: VALARM
DESCRIPTION: REMINDER
TRIGGER; RELATED = START: -PT15M
ACTION: DISPLAY
END: VALARM
END: VEVENT
END: VCALENDARThe thing to understand here is that every iCalendar object starts with BEGIN: VCALENDARand ends with END: VCALENDAR. The meeting part is between BEGIN: VEVENTand END: VEVENT. Within your event, you specify the so-called components. Usually not all components are required and in my POC you can find a stripped-down * .ics file with only the required components. Most of them are self-explanatory, but I will highlight the most interesting ones.
ORGANIZER. Specifies the name and email address of the meeting organizer. You can enter any email and name here to make it appear that the meeting request is from that person.
ATTENDEE. Indicates meeting attendees. If you need many members, you will have multiple ATTENDEE components. Be aware that attendees will not receive a meeting invitation email, it is for display only. You can easily simulate 30 people attending a meeting if you are actually sending an email to one victim.
X-MICROSOFT-SKYPETEAMSMEETINGURL.E If you specify this component will display the button "Connect" to be reminded of the meeting. Unfortunately, when clicked, the system will try to open the specified URL through the desktop app, resulting in an error.
DTSTART, DTSTAMP, DTEND. Indicate the time of the meeting and its duration. I did a clever trick and set the meeting start time 5 minutes earlier than the current time, so it feels like you were 5 minutes late for the meeting. When the victim receives an email, Outlook treats it as a meeting invitation. Sees that the meeting started 5 minutes ago and immediately displays a reminder on the screen. This helps simulate urgency.
How many people do you think would click on a link in the middle of the day when they saw they were late for a meeting?
In this article, I showed you how Outlook handles meeting requests. This should work with any email provider / client that handles *.ics attachments. You can check my POC on github and edit the script and templates to suit your needs.
