Microsoft Authenticator vulnerability let rogue Android apps steal work account access – Help Net Security

If you use Microsoft Authenticator on Android, update it. Researchers at Enclave found a flaw that let any app on your phone quietly take over your work account. The app didn’t need permissions, and you didn’t need to tap anything.

Here’s what happened

Authenticator does more than show six-digit codes. On Android it also acts as a “broker.” When Teams, Outlook or another Microsoft app needs to sign you in, it asks Authenticator, and Authenticator hands back a token: a digital pass that proves you’re logged in. Because Authenticator controls access to your whole Microsoft account, it’s supposed to be very careful about which apps it gives those tokens to.

Ofek Levin, a researcher on Enclave’s fellowship program, found that it wasn’t careful enough. One part of Authenticator could be opened by any app on the device. When an app asked it for a token, Authenticator didn’t check which app was actually asking. It trusted what the app said about itself.

So a…