Slack Patches Vulnerability In Windows Client That Could Be Used To Hijack Files

An anonymous reader quotes a report from Ars Technica: On May 17, researchers at Tenable revealed that they had discovered a vulnerability in the Windows version of the desktop application for Slack, the widely used collaboration service. The vulnerability, in Slack Desktop version 3.3.7 for Windows, could have been used to change the destination of a file download from a Slack conversation to a remote file share owned by an attacker. This would allow the attacker to not only steal the files that were downloaded by a targeted user, but also allow the attacker to alter the files and add malware to them. When victims opened the files, they would get a potentially nasty surprise. Tenable reported the vulnerability to Slack via HackerOne. Slack has issued an update to the Windows desktop client that closes the vulnerability. Once the attacker had changed the default download location, "the attacker could have not only stolen the document, but even inserted malicious code in it so that when opened by victim after download (through the Slack application), their machine would have been infected," writes Tenable's David Wells in a blog post.

Its all fun and games until...

[dryriver]

... your BDSM porn winds up on your colleagues' screens.

Re:

[ArchieBunker]

https://tools.cisco.com/securi... [cisco.com]

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[tlhIngan]

Use the slack.com. I trust the browser makers to keep things secure far more than I trust slack. Every app you install could be reading all your files, scanning your network, capturing your screen, installing keyloggers, so just don't install apps on your PC or Mac. Slack.com works just fine. Now get back to work and quit 'slack'ing!

Except the Slack "app" is just an Electron app - basically a node.js thing wrapped inside Chromium. It's why the app supports all the same SSO gateways - it's just a web browser