Menu
Slack bug paved the way for a hack that can steal user access

Slack bug paved the way for a hack that can steal user access

The problem deals with the postMessage API the chat application uses to exchange data between browser windows

IDG

IDG

One bug in Slack, the popular work chat application, was enough for a security researcher to design a hack that could trick users into handing over access to their accounts.

Bug bounty hunter Frans Rosen noticed he could steal Slack access tokens to user accounts due to a flaw in the way the application communicates data in an internet browser.

“Slack missed an important step when using a technology called postMessage,” Rosen said on Wednesday in an email.  

PostMessage is a kind of command that can let separate browser windows communicate with each other. In Slack, it’s used whenever the chat application opens a new window to enable a voice call.

Ideally, an application that uses postMessage will validate the origin of all data exchanged between separate windows, to keep the process secure. However, Slack wasn’t doing this, according to Rosen.

“Not validating them was a clear indication to me that I could start to do fun stuff,” he wrote in a blog post for security firm Detectify, which he advises.

Last week, he discovered the problem and realized he could siphon a user’s access token through the postMessage bug.

“If you have a browser window, and open a new window by clicking on a link, those two windows can communicate using postMessage,” he said in an email.

But what if one of those windows is an imposter? That’s what Rosen essentially created with a malicious webpage that can hijack the Slack application.

He demonstrated the theoretical hack in a video. The malicious webpage will open a Slack window that then forces a victim’s account to handover its access token.

Fortunately, Slack has fixed the issue. The company has found after a thorough investigation that the flaw was never exploited, according to a posting on HackerOne, a bug bounty platform.

"To work securely with postMessage you always need to verify the origin of every message," Rosen added.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Events

Featured

Slideshows

Channel kicks 2021 into gear as After Hours returns to Auckland

Channel kicks 2021 into gear as After Hours returns to Auckland

After Hours made a welcome return to the channel social calendar with a bumper crowd of partners, distributors and vendors descending on The Pantry at Park Hyatt in Auckland to kick-start 2021.

Channel kicks 2021 into gear as After Hours returns to Auckland
The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

Hundreds of leaders from the New Zealand IT industry gathered at the Hilton in Auckland on 17 November to celebrate the finest female talent in the Kiwi channel and recognise the winners of the Reseller News Women in ICT Awards (WIICTA) 2020.

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards
Show Comments