Menu
Slack bug paved the way for a hack that can steal user access

Slack bug paved the way for a hack that can steal user access

The problem deals with the postMessage API the chat application uses to exchange data between browser windows

IDG

IDG

One bug in Slack, the popular work chat application, was enough for a security researcher to design a hack that could trick users into handing over access to their accounts.

Bug bounty hunter Frans Rosen noticed he could steal Slack access tokens to user accounts due to a flaw in the way the application communicates data in an internet browser.

“Slack missed an important step when using a technology called postMessage,” Rosen said on Wednesday in an email.  

PostMessage is a kind of command that can let separate browser windows communicate with each other. In Slack, it’s used whenever the chat application opens a new window to enable a voice call.

Ideally, an application that uses postMessage will validate the origin of all data exchanged between separate windows, to keep the process secure. However, Slack wasn’t doing this, according to Rosen.

“Not validating them was a clear indication to me that I could start to do fun stuff,” he wrote in a blog post for security firm Detectify, which he advises.

Last week, he discovered the problem and realized he could siphon a user’s access token through the postMessage bug.

“If you have a browser window, and open a new window by clicking on a link, those two windows can communicate using postMessage,” he said in an email.

But what if one of those windows is an imposter? That’s what Rosen essentially created with a malicious webpage that can hijack the Slack application.

He demonstrated the theoretical hack in a video. The malicious webpage will open a Slack window that then forces a victim’s account to handover its access token.

Fortunately, Slack has fixed the issue. The company has found after a thorough investigation that the flaw was never exploited, according to a posting on HackerOne, a bug bounty platform.

"To work securely with postMessage you always need to verify the origin of every message," Rosen added.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments