Ever wondered how meeting invitations work in Microsoft Teams and Google Meet? Recently, I was working on a social engineering issue, and a random thought occurred to me: how do meeting invitations actually work, can they somehow be used in fraudulent schemes?
Yes, such a thought has already been discussed before, and this method has already been used. But no one has ever explained how it works. I have not been able to find a single blog that technically describes this attack. Therefore, I decided to delve into it myself, in order to tell in human language to everyone who is interested in penetration tests and security issues in general.
What did I want to do in this attack?
Send a fake meeting invitation, creating a sense of urgency so that the victim does not try to figure out the issue, but simply follows my link asking for credentials.
Appointment creation (in Outlook) usually works like this:
click the New Appointment button, which will open a page with email fields, pre-filled team template and meeting URL
set the name of the meeting and specify the attendees
«», , .
?
, iCalendar. , iCalendar, email . , protonmail.
iCalendar?
« iCalendar (, , , / ). iCalendar ; , . .ics»
iCalendar Outlook, Google, Yahoo, Apple . Outlook.
iCalendar . protonmail, .
BEGIN:VCALENDAR
METHOD:REQUEST
PRODID:Microsoft Exchange Server 2010
VERSION:2.0
BEGIN:VTIMEZONE
TZID:GTB Standard Time
BEGIN:STANDARD
DTSTART:16010101T040000
TZOFFSETFROM:+0300
TZOFFSETTO:+0200
RRULE:FREQ=YEARLY;INTERVAL=1;BYDAY=-1SU;BYMONTH=10
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:16010101T030000
TZOFFSETFROM:+0200
TZOFFSETTO:+0300
RRULE:FREQ=YEARLY;INTERVAL=1;BYDAY=-1SU;BYMONTH=3
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
ORGANIZER;CN=ExAndroid Developer:mailto:<redacted>@outlook.com
ATTENDEE;ROLE=REQ-PARTICIPANT;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;CN=<redacted>@protonmail.com:mailto:<redacted>@protonmail.com
DESCRIPTION;LANGUAGE=en-US:<stripped>\n\n
UID:040000008200E00074C5B7101A82E00800000000508CC0468E28D701000000000000000
01000000096DF011F20A29943A70B5DA5047021A5
SUMMARY;LANGUAGE=en-US:Test meeting
DTSTART;TZID=GTB Standard Time:20210403T000000
DTEND;TZID=GTB Standard Time:20210404T000000
CLASS:PUBLIC
PRIORITY:5
DTSTAMP:20210403T103619Z
TRANSP:OPAQUE
STATUS:CONFIRMED
SEQUENCE:0
LOCATION;LANGUAGE=en-US:Microsoft Teams Meeting
X-MICROSOFT-CDO-APPT-SEQUENCE:0
X-MICROSOFT-CDO-OWNERAPPTID:-570210331
X-MICROSOFT-CDO-BUSYSTATUS:TENTATIVE
X-MICROSOFT-CDO-INTENDEDSTATUS:BUSY
X-MICROSOFT-CDO-ALLDAYEVENT:FALSE
X-MICROSOFT-CDO-IMPORTANCE:1
X-MICROSOFT-CDO-INSTTYPE:0
X-MICROSOFT-SKYPETEAMSMEETINGURL:https://teams.microsoft.com/l/meetup-join/
19%3ameeting_YmM1MjRmMTktYjA2N<stripped>cd8%22%7d
X-MICROSOFT-SCHEDULINGSERVICEUPDATEURL:https://api.scheduler.teams.microsof
t.com/teams/dc<stripped>DAyMmZj@thread.v2/0
X-MICROSOFT-SKYPETEAMSPROPERTIES:{"cid":"19:meeting_YmM1MjRmMTktYjA2Ny00YWQ
4LWI1NWEtZmE1NGVlMDAyMmZj@thread.v2"\,"private":true\,"type":0\,"mid":0\,"
rid":0\,"uid":null}
X-MICROSOFT-ONLINEMEETINGCONFLINK:conf:sip:<redacted>\;gruu\;opaque=
app:conf:focus:id:teams:2:0!19:meeting_YmM1MjRmMTktYjA2Ny00YWQ4LWI1NWEtZmE
1NGVlMDAyMmZj-thread.v2!56474ffc245241c5ab4081a127cc1cd8!dcf23acb18fc41d28
6acf752f1ca658d
X-MICROSOFT-DONOTFORWARDMEETING:FALSE
X-MICROSOFT-DISALLOW-COUNTER:FALSE
X-MICROSOFT-LOCATIONS:[ { "DisplayName" : "Microsoft Teams Meeting"\, "Loca
tionAnnotation" : ""\, "LocationSource" : 0\, "Unresolved" : false\, "Loca
tionUri" : "" } ]
BEGIN:VALARM
DESCRIPTION:REMINDER
TRIGGER;RELATED=START:-PT15M
ACTION:DISPLAY
END:VALARM
END:VEVENT
END:VCALENDAR
, iCalendar BEGIN: VCALENDAR
END: VCALENDAR
. BEGIN: VEVENT
END: VEVENT
. . , POC *.ics . , .
ORGANIZER. . email , , .
ATTENDEE. . , ATTENDEE. , , . 30 , .
X-MICROSOFT-SKYPETEAMSMEETINGURL. , «». , URL- , .
DTSTART, DTSTAMP, DTEND. . 5 , , 5 . email, Outlook . , 5 , . .
, , , ?
, Outlook . / email-, *.ics. POC github .
→ :
Telegram-, . .