7 ms·

Yea, I think most users think slack is a safe space. They haven't been conditioned to be suspicious of messages on slack like they have with email. It's a prett

Yea, I think most users think slack is a safe space. They haven't been conditioned to be suspicious of messages on slack like they have with email. It's a pretty ripe attack vector. Was bored the other week and found a ton of slack web hook urls in public github repos. I think it would be a pretty great way to do some phishing, just need to scrape the urls and brute force channel names with messages with links to websites you own.

SCHiM 5y ago
It's the same old same old. Like you correctly identified it's a new place, it looks different. People don't think an attacker could approach them over IM, but they can. But the problem goes beyond that. Many organizations have disabled sharing executable file formats in attachments over e-mail. GMail flat-out prevents you from sharing executables, and macro enabled word documents as attachments, even when put into a zip file. But on Microsoft teams? I sent a zip file with 8 unsigned executables to a colleague a few days ago. No warnings, no messages, no nothing :)
- recursive 5y ago
  I don't know if it's true, but a co-worker of mine said that, "in the wild" signed binaries are positively correlated with being malware. I don't think the signing itself does much.
  - manquer 5y ago
    Perhaps not in itself. The lack of scans is concerning though
  - slver 5y ago
    Signed by real vendors?
    - recursive 5y ago
      Depends what you mean by that, but probably not. But, signed definitely. The main problem here is that there doesn't seem to be an authoritative vendor list of the "real".
- zeusk 5y ago
  For general public I can see how that is helpful if they can't decide if a foreign executable is trust worthy or if they execute everything with admin/root privilege. As for me, I really hate this "feature". I work with IHVs and often have to share private binaries and it's a chore using xcopy/sfpcopy to their bespoke network path, from where I guess then someone manually copies over to their local subnet. We should have a more robust mechanism in place than to outright ban sharing of executable files. Windows Smartscreen and Mac's Gatekeeper method of online checksum/signature verification is sort of interesting.
  - 650REDHAIR 5y ago
    1000 times no. You need to build security for the lowest common denominator.
    - zeusk 5y ago
      Which is what Defender smartscreen and Gatekeeper are. With their full on setting, they give you a big fat warning on running files from internet. This is like banning guns and cars because they can kill people. Also, you do 24 hours of lemons?
munk-a 5y ago
I think it's actually a pretty unsurprising assumption. Slack is significantly more vulnerable service than a lot of other chat applications due to the fact that it has a native webclient that allows cookie based authentication. Every chat program in existence is going to use something extremely similar to maintain user sessions - having either authentication credentials or (preferably) an access token written to disk to allow users to avoid re-entering passwords every time the program falls out of memory. I think with slack the danger is exacerbated by the fact that this value gets stored in a cookie that is a lot easier to gain access to - and, once you have it it has a much better documented format than whatever MSN Messanger might roll in-house. We're essentially just talking about an added layer of security by obscurity when it comes to the format - but actually nabbing a cookie is easier than gaining arbitrary file access.
- slver 5y ago
  Modern web doesn’t need cookie auth so let’s hope they move away from it. Cookies in general are an idea past expiration date.
deleted 5y ago
[deleted]

SCHiM 5y ago

It's the same old same old. Like you correctly identified it's a new place, it looks different. People don't think an attacker could approach them over IM, but they can. But the problem goes beyond that. Many organizations have disabled sharing executable file formats in attachments over e-mail. GMail flat-out prevents you from sharing executables, and macro enabled word documents as attachments, even when put into a zip file. But on Microsoft teams? I sent a zip file with 8 unsigned executables to a colleague a few days ago. No warnings, no messages, no nothing :)

recursive 5y ago
I don't know if it's true, but a co-worker of mine said that, "in the wild" signed binaries are positively correlated with being malware. I don't think the signing itself does much.
- manquer 5y ago
  Perhaps not in itself. The lack of scans is concerning though
- slver 5y ago
  Signed by real vendors?
  - recursive 5y ago
    Depends what you mean by that, but probably not. But, signed definitely. The main problem here is that there doesn't seem to be an authoritative vendor list of the "real".
zeusk 5y ago
For general public I can see how that is helpful if they can't decide if a foreign executable is trust worthy or if they execute everything with admin/root privilege. As for me, I really hate this "feature". I work with IHVs and often have to share private binaries and it's a chore using xcopy/sfpcopy to their bespoke network path, from where I guess then someone manually copies over to their local subnet. We should have a more robust mechanism in place than to outright ban sharing of executable files. Windows Smartscreen and Mac's Gatekeeper method of online checksum/signature verification is sort of interesting.
- 650REDHAIR 5y ago
  1000 times no. You need to build security for the lowest common denominator.
  - zeusk 5y ago
    Which is what Defender smartscreen and Gatekeeper are. With their full on setting, they give you a big fat warning on running files from internet. This is like banning guns and cars because they can kill people. Also, you do 24 hours of lemons?

munk-a 5y ago

I think it's actually a pretty unsurprising assumption. Slack is significantly more vulnerable service than a lot of other chat applications due to the fact that it has a native webclient that allows cookie based authentication. Every chat program in existence is going to use something extremely similar to maintain user sessions - having either authentication credentials or (preferably) an access token written to disk to allow users to avoid re-entering passwords every time the program falls out of memory. I think with slack the danger is exacerbated by the fact that this value gets stored in a cookie that is a lot easier to gain access to - and, once you have it it has a much better documented format than whatever MSN Messanger might roll in-house. We're essentially just talking about an added layer of security by obscurity when it comes to the format - but actually nabbing a cookie is easier than gaining arbitrary file access.

slver 5y ago
Modern web doesn’t need cookie auth so let’s hope they move away from it. Cookies in general are an idea past expiration date.

deleted 5y ago

[deleted]