We conducted an experimental security analysis of the third-party app model in two widely-used Business Collaboration Platforms (BCPs) — Microsoft Teams and Slack. Specifically, we examined various types of interactions between BCP apps and users and discovered that the access control systems in BCPs cannot adequately confine a third-party app's behaviors. Therefore, such design flaws allow malicious apps to escalate their privilege and violate the confidentiality and integrity of different resources in BCP workspaces.

• Why Business Collaboration Platforms?

Business Collaboration Platforms (BCPs), like Slack and Microsoft Teams, are indispensable collaboration and productivity tools. Beyond multi-user chat features, BCPs allow users to install third-party apps. For example, users can initiate video calls with Zoom or store files on DropBox inside their own BCP workspace. The widespread usage of BCPs in remote work environments implies that a lot of sensitive information passes through them. With the potential ability to access such information, BCP apps can lead to serious security and privacy concerns.

• What are the key findings?

We find that there are inherent design flaws in the access control model of BCPs, causing it to violate security principles such as least privilege and complete mediation. This allows malicious apps to escalate their privilege and violate the confidentiality and integrity of private chat messages and third-party resources connected to BCPs.

• Why should I care about these design flaws?

Suppose you are installing an app (which is secretly under an attacker's control) into your BCP workspace. Even if you have carefully checked the permissions requested by the app and ensured that no sensitive data are granted to it, the attacker can still exploit these design flaws to bypass the expected access control enforced by BCP. For example, the attacker can:

• Abuse other benign apps to send emails on your behalf.

• Abuse other benign apps to retweet any content using your account.

• Hijack your interaction with the official Zoom app and create attacker-controlled Zoom meetings.

• Leak private messages that it does not have permission to read.

You can find the video demos of these attacks below.

• How can there be an attacker-controlled app in my workspace?

A malicious app can appear in your trusted workspace in many different ways:

• An attacker tricks one of the users to install a malicious app.

• A user of the workspace is curious of other's private data and turns into an attacker.

• A previously installed benign app is compromised or becomes malicious.