【Laruan】

A security researcher has uncovered a flaw in Slack that could've been exploited to steal files over the business messaging app and Laruanpotentially spread malware.

The flaw involves Slack's Windows desktop app, and how it can automatically send downloaded files to a certain destination—whether it be on your PC or to an online storage server. You can set a download location in the app's preferences section. However, David Wells, a researcher at the security firm Tenable, noticed there's another way to configure the option: Via a special link.

"Crafting a link like 'slack://settings/?update={ 'PrefSSBFileDownloadPath':'}' would change the default download location if clicked," Wells wrote in a blog post on the vulnerability.

Wells realized the same function could be abused. Imagine a hacker using the links to secretly reconfigure a Slack desktop app to send all downloaded files to an outside server. "Using this attack vector, an insider could exploit this vulnerability for corporate espionage, manipulation, or to gain access to documents outside of their purview," Well's security firm Tenable said in a separate report.

Mashable Light Speed Want more out-of-this world tech, space and science stories? Sign up for Mashable's weekly Light Speed newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up!

Original image has been replaced. Credit: Mashable

The vulnerability can also pave the way for potential malware infections. Any downloaded files sent to the hacker-controller server can be altered and booby-trapped to include malicious code. The attack will commence once the victim opens the file on the Slack desktop app.

The main obstacle of carrying out this attack is circulating the hacker-created links to people on Slack, which keeps its channels private to paying clients and their companies. To pull this off, Wells noticed how Slack channels can be configured to subscribe to RSS feeds, including threads on Reddit.

"I could make a post to a very popular Reddit community that Slack users around the world are subscribed to," Wells said. The hacker-created link will then populate inside the Slack channel and possibly attract some clicks.

"This technique could be unmasked by savvy Slack users, however if decades of phishing campaigns have taught us anything, it's that users click links, and when leveraged through an untrusted RSS feed, the impact can get much more interesting," he added.

Slack has patched the flaw in version 3.4.0 of the Windows desktop app. "We investigated and found no indication that this vulnerability was ever utilized, nor reports that our users were impacted," the company said in an email.

---

Featured Video For You

---

Chadwick Boseman tapped to play history's first black samurai

---

• Games
• Tech
• Life
• Shopping
• Entertainment
• Science
• Social Good
• Deals

• How to Squeeze the Most Out of Your iPhone's Battery
• Little Caesars joins increasingly automated McDonalds with new robot
• Another nor'easter may hit the East Coast next week. Yes, seriously
• Facebook and Google go to great lengths to stop leakers
• Waitin’ on the Student Debt Jubilee
• Blockchain bros are taking over SXSW 2018, because of course they are
• In startling coincidence, Stephen Hawking died on Einstein’s birthday
• Leaked documents reveal how Amazon Prime Originals are making money
• NYT mini crossword answers for May 12, 2025
• Google rebrands Android Wear smartwatch software as Wear OS

• Donald Trump is selling the news over Twitter—and everyone's buying
• The Motiv smart ring is a fitness tracking wearable for your finger
• Another organ has been hiding in your belly all along
• The Indiana Pacers found a way to troll Mariah Carey
• PSA: You can lawfully refuse to pay service charge at restaurants, hotels in this country
• Billie Lourd posts touching Instagram tribute to Carrie Fisher and Debbie Reynolds
• Ronda Rousey still made $62,500 per second in her brutal UFC 207 loss
• India's largest mobile wallet app Paytm gets regulatory nod to operate its own Payments Bank
• HP’s Spectre x360 bulks up to add power and battery
• Bitcoin may be the biggest winner of 2017 so far

• Best robot vacuum deal: Save $200 on Eufy X10 Pro Omni robot vacuum
• Force Multiplier
• Fans get more insight on Luke in crucial 'Last Jedi' deleted scene
• All the practical advice the Fab 5 have given on Netflix's 'Queer Eye'
• Against Fear
• 'Shadow of the Tomb Raider' completes young Lara Croft's journey this fall
• Google rebrands Android Wear smartwatch software as Wear OS
• 'Shadow of the Tomb Raider' completes young Lara Croft's journey this fall
• This fat bear's before and after photos are stunning
• 'Call Me By Your Name' merged with Monet paintings is Instagram genius

• The State of PC Gaming in 2016
• Wolf Blitzer stars in CNN's virtual reality news app for Oculus Rift
• Stephen Hawking hosted a party for time travelers, but no one came
• Why is Hawkeye missing from the 'Avengers: Infinity War' marketing?
• Time to Unite
• Apple's next MacBook or iPad might have a haptic 'keyless' keyboard
• In startling coincidence, Stephen Hawking died on Einstein’s birthday
• It's 2018, and dongle hell has only gotten worse
• SpaceX's Starlink satellite launch in pictures
• Google rebrands Android Wear smartwatch software as Wear OS