【】

A security researcher has uncovered a flaw in Slack that could've been exploited to steal files over the business messaging app and potentially spread malware.
The flaw involves Slack's Windows desktop app, and how it can automatically send downloaded files to a certain destination—whether it be on your PC or to an online storage server. You can set a download location in the app's preferences section. However, David Wells, a researcher at the security firm Tenable, noticed there's another way to configure the option: Via a special link.
"Crafting a link like 'slack://settings/?update={ 'PrefSSBFileDownloadPath':
Wells realized the same function could be abused. Imagine a hacker using the links to secretly reconfigure a Slack desktop app to send all downloaded files to an outside server. "Using this attack vector, an insider could exploit this vulnerability for corporate espionage, manipulation, or to gain access to documents outside of their purview," Well's security firm Tenable said in a separate report.

The vulnerability can also pave the way for potential malware infections. Any downloaded files sent to the hacker-controller server can be altered and booby-trapped to include malicious code. The attack will commence once the victim opens the file on the Slack desktop app.
The main obstacle of carrying out this attack is circulating the hacker-created links to people on Slack, which keeps its channels private to paying clients and their companies. To pull this off, Wells noticed how Slack channels can be configured to subscribe to RSS feeds, including threads on Reddit.
"I could make a post to a very popular Reddit community that Slack users around the world are subscribed to," Wells said. The hacker-created link will then populate inside the Slack channel and possibly attract some clicks.
"This technique could be unmasked by savvy Slack users, however if decades of phishing campaigns have taught us anything, it's that users click links, and when leveraged through an untrusted RSS feed, the impact can get much more interesting," he added.
Slack has patched the flaw in version 3.4.0 of the Windows desktop app. "We investigated and found no indication that this vulnerability was ever utilized, nor reports that our users were impacted," the company said in an email.
Featured Video For You
Chadwick Boseman tapped to play history's first black samurai
相关文章
PlayStation Now game streaming is coming to PC
Sony's PlayStation Now service is launching for Windows PC, meaning subscribers will soon be able to2025-04-03- 名記:姆巴佩有55%-60%可能加盟皇馬 無其他隊競爭_比賽_歐冠_球迷www.ty42.com 日期:2022-03-11 09:31:00| 評論(已有334671條評論)2025-04-03
- 波帥無能累死三軍 !下課命運已注定 巴黎穆帥何在?_波切蒂諾都_多納魯馬_梅西www.ty42.com 日期:2022-03-10 21:01:00| 評論(已有334599條評論)2025-04-03
- 萊萬震驚於拜仁無人找他續約 若離隊曼聯準備報價_未來_的合同_皇馬www.ty42.com 日期:2022-03-10 12:31:00| 評論(已有334524條評論)2025-04-03
Pole vaulter claims his penis is not to blame
Following the cringeworthy moment in which pole vaulter Hiroki Ogita's penis grazed the bar and he f2025-04-03媒體人:中超頂薪300萬 哪個行業排名前100拿不到這個數?
媒體人:中超頂薪300萬 哪個行業排名前100拿不到這個數?_廣州隊_足球_球員www.ty42.com 日期:2022-03-10 16:31:00| 評論(已有334560條評論)2025-04-03
最新评论