I figured this may be an interesting attack vector, so with some grepping I found the area of code that processes these protocol links. As a Slack user, one feature that I was already familiar with was the support for “ slack://” hyperlinks. Slack is an Electron app, which makes reverse engineering quite easy for us.

We will go over some interesting applications of this attack. This entire technique relied on how Slack treated clickable links and what was possible with certain slack:// links. While on the attacker’s server, the attacker could have not only stolen the document, but even inserted malicious code in it so that when opened by victim after download (through Slack application), their machine would have been infected. This could have allowed all future downloaded documents by the victim to end up being uploaded to an attacker owned file server until the setting is manually changed back by the victim. The vulnerability could have allowed a remote attacker to submit a masqueraded link in a slack channel, that “if clicked” by a victim, would silently change the download location setting of the slack client to an attacker owned SMB share. The vulnerability was reported to Slack via HackerOne based on our coordinated disclosure policy and Slack has patched this issue in one of its latest updates, v3.4.0. We hope you’ll give Slack a try.I’m going to go over an interesting feature abuse that could have been used to steal and even manipulate downloads from Slack users using the Slack desktop app on Windows. Scientifically proven (or at least rumored) to make your working life simpler, more pleasant, and more productive. Customize your notifications so you stay focused on what matters.Easily search a central knowledge base that automatically indexes and archives your team’s past conversations and files.Integrate into your workflow, the tools and services you already use including Google Drive, Salesforce, Dropbox, Asana, Twitter, Zendesk, and more.

Share and edit documents and collaborate with the right people all in Slack.

Message or call any person or group within your team.

Communicate with your team and organize your conversations by topics, projects, or anything else that matters to your work.

Slack is available on any device, so you can find and access your team and your work, whether you’re at your desk or on the go. Check off your to-do list and move your projects forward by bringing the right people, conversations, tools, and information you need together. Slack brings team communication and collaboration into one place so you can get more work done, whether you belong to a large enterprise or a small business.

Slackdownload