【Watch Black Water: Abyss Online】

A security researcher has uncovered a flaw in Slack that could've been exploited to steal files over the business messaging app and Watch Black Water: Abyss Onlinepotentially spread malware.

The flaw involves Slack's Windows desktop app, and how it can automatically send downloaded files to a certain destination—whether it be on your PC or to an online storage server. You can set a download location in the app's preferences section. However, David Wells, a researcher at the security firm Tenable, noticed there's another way to configure the option: Via a special link.

"Crafting a link like 'slack://settings/?update={ 'PrefSSBFileDownloadPath':'}' would change the default download location if clicked," Wells wrote in a blog post on the vulnerability.

Wells realized the same function could be abused. Imagine a hacker using the links to secretly reconfigure a Slack desktop app to send all downloaded files to an outside server. "Using this attack vector, an insider could exploit this vulnerability for corporate espionage, manipulation, or to gain access to documents outside of their purview," Well's security firm Tenable said in a separate report.

Mashable Light Speed Want more out-of-this world tech, space and science stories? Sign up for Mashable's weekly Light Speed newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up!

Original image has been replaced. Credit: Mashable

The vulnerability can also pave the way for potential malware infections. Any downloaded files sent to the hacker-controller server can be altered and booby-trapped to include malicious code. The attack will commence once the victim opens the file on the Slack desktop app.

The main obstacle of carrying out this attack is circulating the hacker-created links to people on Slack, which keeps its channels private to paying clients and their companies. To pull this off, Wells noticed how Slack channels can be configured to subscribe to RSS feeds, including threads on Reddit.

"I could make a post to a very popular Reddit community that Slack users around the world are subscribed to," Wells said. The hacker-created link will then populate inside the Slack channel and possibly attract some clicks.

"This technique could be unmasked by savvy Slack users, however if decades of phishing campaigns have taught us anything, it's that users click links, and when leveraged through an untrusted RSS feed, the impact can get much more interesting," he added.

Slack has patched the flaw in version 3.4.0 of the Windows desktop app. "We investigated and found no indication that this vulnerability was ever utilized, nor reports that our users were impacted," the company said in an email.

---

Featured Video For You

---

Chadwick Boseman tapped to play history's first black samurai

---

• Deals
• Life
• Tech
• Science
• Shopping
• Social Good
• Digital Culture
• Entertainment

• Operation Snowflake
• The 8 million American votes that can't be polled
• Why Meghan Markle is so much more than just 'Prince Harry's girlfriend'
• NASA's huge spacecraft will soon launch to alluring ocean world
• Begone, President
• This is why we still need Obama in our lives
• Nickelodeon's eerily accurate kids' poll picks the next president
• Naomi Klein likens Australia's refugee treatment to Trump's 'insane' wall
• Good Girls Gone Mad
• Naomi Klein likens Australia's refugee treatment to Trump's 'insane' wall

• Coach Taylor to Tim Riggins: 'Friday Night Lights' crushes, ranked
• The accidental Super Like: Tinder's most awkward phenomenon
• Eric Trump tweets that he hates ‘disloyal people’ and is swiftly reminded of his own family
• Elon Musk isn't joining Twitter's board of directors after all
• 'Wordle' today: Here's the answer, hints for April 12
• Make playlists when you travel for nostalgia
• 'The Office' episodes, ranked. (All 185 of them.)
• Kellyanne Conway's getting mocked for trying to diss her husband off the record
• WhatsApp testing hiding 'last seen' status from specific contacts
• Amazon Prime Video's 10 best hidden gems for when you need something new to you

• Jacked Up
• How Gotham Chopra mines the sports world for deeper meaning
• Apple should have seen the fake apps coming
• Global warming to cause fastest rate of sea level rise in human history
• Uniting Against White Supremacy in Charlottesville
• How to avoid the bogus app trap on the iOS App Store
• 'Dishonored 2' is gaming's best argument yet against photorealism
• How to avoid the bogus app trap on the iOS App Store
• It Is Happening Again
• Global warming to cause fastest rate of sea level rise in human history

• Juneteenth, From Atlanta to Oakland
• Mae Whitman dropped an 'Arrested Development' joke in an election day post
• Chinese mall has a 'nursery' where you can drop your husband and shop in peace
• Global warming to cause fastest rate of sea level rise in human history
• Reading like a Bureaucrat
• 'Stranger Things' adds two '80s icons to Season 2 cast
• Destiny's Child might have just won the #MannequinChallenge
• Flying spaghetti monster and unworldly life filmed in deep sea footage
• Whale Vomit Episode 8
• 4 unusual deck choices at the 'Hearthstone' World Championships