【Watch High Test Girls Online】

A security researcher has uncovered a flaw in Slack that could've been exploited to steal files over the business messaging app and Watch High Test Girls Onlinepotentially spread malware.

The flaw involves Slack's Windows desktop app, and how it can automatically send downloaded files to a certain destination—whether it be on your PC or to an online storage server. You can set a download location in the app's preferences section. However, David Wells, a researcher at the security firm Tenable, noticed there's another way to configure the option: Via a special link.

"Crafting a link like 'slack://settings/?update={ 'PrefSSBFileDownloadPath':'}' would change the default download location if clicked," Wells wrote in a blog post on the vulnerability.

Wells realized the same function could be abused. Imagine a hacker using the links to secretly reconfigure a Slack desktop app to send all downloaded files to an outside server. "Using this attack vector, an insider could exploit this vulnerability for corporate espionage, manipulation, or to gain access to documents outside of their purview," Well's security firm Tenable said in a separate report.

Mashable Light Speed Want more out-of-this world tech, space and science stories? Sign up for Mashable's weekly Light Speed newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up!

Original image has been replaced. Credit: Mashable

The vulnerability can also pave the way for potential malware infections. Any downloaded files sent to the hacker-controller server can be altered and booby-trapped to include malicious code. The attack will commence once the victim opens the file on the Slack desktop app.

The main obstacle of carrying out this attack is circulating the hacker-created links to people on Slack, which keeps its channels private to paying clients and their companies. To pull this off, Wells noticed how Slack channels can be configured to subscribe to RSS feeds, including threads on Reddit.

"I could make a post to a very popular Reddit community that Slack users around the world are subscribed to," Wells said. The hacker-created link will then populate inside the Slack channel and possibly attract some clicks.

"This technique could be unmasked by savvy Slack users, however if decades of phishing campaigns have taught us anything, it's that users click links, and when leveraged through an untrusted RSS feed, the impact can get much more interesting," he added.

Slack has patched the flaw in version 3.4.0 of the Windows desktop app. "We investigated and found no indication that this vulnerability was ever utilized, nor reports that our users were impacted," the company said in an email.

---

Featured Video For You

---

Chadwick Boseman tapped to play history's first black samurai

---

• Life
• Games
• Deals
• Entertainment
• Social Good
• Tech
• Digital Culture
• Science

• The Baffler’s May Day Round Up
• Hackers leak copy of Michelle Obama's passport, but is it real?
• The Facebook feature fueling the police brutality protests in America
• Wait a second—Kim Kardashian might vote for Donald Trump
• Norrie vs. Diallo 2025 livestream: Watch Madrid Open for free
• 'Harry Potter' fans, rejoice: You can now discover your true Patronus
• Creative mom puts her napping twins into awesome settings
• Hillary Clinton's 'Between Two Ferns' interview is hilariously awkward
• A Typical Wall Street Republican
• Mark Zuckerberg reveals his New Year's resolution

• How to Say No in Turkish: Navigating a New Language
• Google Pixel 8, Pixel 8 Pro officially announced.
• The Captain’s Doll
• 'Our Flag Means Death' Season 2: Gayer and darker pirates tales ahead
• Rimbaud in the Alps: A Harrowing, Beautiful Letter from 1878
• Pixel 8 vs. Pixel 8 Pro: What are the biggest differences?
• What is premature ejaculation?
• In the Victorian Mind, Moss Equaled Sex
• Pixel 8 Pro has a new temperature sensor. Can it 'read' an overheated iPhone 15 Pro?
• The History of the Grand Guignol Is Expectably Terrifying

• Against Fear
• Scientists detect mysterious repeating signals from deep, deep space
• German authorities have identified Angela Merkel's hacker
• Samsung might launch Galaxy S10 and Galaxy F at February event
• NYT Strands hints, answers for May 18
• Nielsen compares 'Bird Box' numbers to other Netflix originals
• Drone sightings cause more chaos at another UK airport, military gets called in
• Thousands of gay men could finally be pardoned for historical 'offences'
• NYT Strands hints, answers for April 23
• Twitter will broadcast NBA games with a camera focused on a single player

• Reality Distortion Field: 10 Things Apple Won't Directly Say But We'll Infer About the iPhone X
• No one, not even the people in the photos, wants this lost wedding album
• I tried to ignore Trump for a whole month. Here's what I learned.
• Amazon Echo Auto is finally here
• NYT Connections Sports Edition hints and answers for May 19: Tips to solve Connections #238
• 'Black Mirror' creator has a savage response to 'Bandersnatch' haters
• Twitter will broadcast NBA games with a camera focused on a single player
• 'Black Mirror' creator has a savage response to 'Bandersnatch' haters
• Best robot vacuum deal: Save $320 on Shark Robot Vacuum and Mop
• The 'Game of Thrones' prequel has a diverse cast and a woman directing