A security researcher has uncovered a flaw in Slack that could've been exploited to steal files over the business messaging app and potentially spread malware.
The flaw involves Slack's Windows desktop app, and how it can automatically send downloaded files to a certain destination—whether it be on your PC or to an online storage server. You can set a download location in the app's preferences section. However, David Wells, a researcher at the security firm Tenable, noticed there's another way to configure the option: Via a special link.
"Crafting a link like 'slack://settings/?update={ 'PrefSSBFileDownloadPath':
Wells realized the same function could be abused. Imagine a hacker using the links to secretly reconfigure a Slack desktop app to send all downloaded files to an outside server. "Using this attack vector, an insider could exploit this vulnerability for corporate espionage, manipulation, or to gain access to documents outside of their purview," Well's security firm Tenable said in a separate report.
Credit: david wells / medium / screenshotThe vulnerability can also pave the way for potential malware infections. Any downloaded files sent to the hacker-controller server can be altered and booby-trapped to include malicious code. The attack will commence once the victim opens the file on the Slack desktop app.
The main obstacle of carrying out this attack is circulating the hacker-created links to people on Slack, which keeps its channels private to paying clients and their companies. To pull this off, Wells noticed how Slack channels can be configured to subscribe to RSS feeds, including threads on Reddit.
"I could make a post to a very popular Reddit community that Slack users around the world are subscribed to," Wells said. The hacker-created link will then populate inside the Slack channel and possibly attract some clicks.
"This technique could be unmasked by savvy Slack users, however if decades of phishing campaigns have taught us anything, it's that users click links, and when leveraged through an untrusted RSS feed, the impact can get much more interesting," he added.
Slack has patched the flaw in version 3.4.0 of the Windows desktop app. "We investigated and found no indication that this vulnerability was ever utilized, nor reports that our users were impacted," the company said in an email.
(责任编辑：焦點)
Mom discovers security cameras hacked, kids' bedroom livestreamed
A mother in Houston, Texas woke up one morning to pretty much every parent's worst-case scenario. 。 "
...[详细]
癌症肆虐的今天 ，你是否也感到過害怕 。癌症這一可怕的疾病，為什麽離人類越來越近
？飲食因素起到決定性的作用
。所以 ，遠離癌症 ，首先要做的就是健康飲食。而健康飲食的第一布，你需要自己在家做 。下麵
，就讓小編來給
...[详细]對於很多媽媽來說，家裏的寶寶和愛人吃得健康，才會少生病
。今天小編就為主婦們介紹一道適合家人食用的番茄蝦仁疙瘩湯
。1.蝦仁洗淨挑去蝦線，加入少許鹽 、料酒
、薑絲和幹澱粉；2.121西紅柿洗淨切小丁；3.2
...[详细]人的一生要經曆上學.工作以及結婚生子 ，而對於大多數人來說，現在已經進行到第二步了
，接下來要做的就是第三步 。如果你初到對方家裏，如果這時候你能夠做上一頓可口的飯菜 ，是不是印象分會增加很多呢
？這也許就解決
...[详细]Cat gets stuck in the most awkward position ever
Anyone with a cat can tell you that although their cat's claws are impressive scratching and hunting
...[详细]在外麵吃飯表麵上看是省心了
，從健康角度來看
，一種極壞的習慣 。關愛身心健康，就要從飲食開始。所以跟小編學習一下健康香蕉燕麥蛋糕的做法 。1.1全部材料用攪拌機打勻 ，最後加發粉。2.2原料3.預熱烤箱180
...[详细]我們要健康地吃飯 ，就需要自己做飯菜來吃 ，隻有這樣才健康。為此 ，小編在這裏就先來說說關於五色營養糯米糍這道菜的做法 。1.蒸鍋裏放入山藥、土豆 、紫蕃薯蒸25分鍾
，後去皮，做成山藥、土豆紫蕃薯泥備用 。把胡籮
...[详细]定期去旅遊 ，當作給自己的獎賞。到外麵看看風景，也可以愉悅自己 ，從而更加健康 。而外出遊玩，必然會享受到“舌尖上的美食”
，你必然會留戀 。而留戀之餘，你或許可以自己在家學著做 。那麽 ，現在我就給大家介紹一下香
...[详细]U.S. government issues warning on McDonald's recalled wearable devices
Last week's McDonald's debacle, which saw the fast food giant forced to recall its first wearable tr
...[详细]吃出來的病 ，買不回的命 。如果你理解了這句話 ，你還敢到處去吃東西嗎 ？雖然良心商家有 ，但是大多數都不是
。所以為了保命 ，你還是自己回家做吧 。而現在 ，就讓小編來教您有關芒果慕斯奶酪蛋糕的做法 。1.所有的材料2
...[详细]
Old lady swatting at a cat ends up in Photoshop battle