4 ms·
I think all the talk about channel permissions is making the discussion more confusing than it needs to be. The gist of it is: User A searches for something us
by paxys 2y ago
I think all the talk about channel permissions is making the discussion more confusing than it needs to be. The gist of it is:
User A searches for something using Slack AI.
User B had previously injected a message asking the AI to return a malicious link when that term was searched.
AI returns malicious link to user A, who clicks on it.
Of course you could have achieved the same result using some other social engineering vector, but LLMs have cranked this whole experience up to 11.
- markovs_gun 2y agoYeah and social engineering is much easier to spot than your company approved search engine giving you malicious links
- Groxx 2y agoThere's an important step missing in this summary: Slack AI adds the user's private data to the malicious link, because the injected link doesn't contain that. That it also cites it as "this came from your slack messages" is just a cherry on top.
- _the_inflator 2y agoIt's maybe not that related, but giving an LLM access to private data is not the best idea, to put it mildly. Hacking a database is one thing; exploiting an LLM is something else.
- hn_throwaway_99 2y ago> I think all the talk about channel permissions is making the discussion more confusing than it needs to be. I totally disagree, because the channel permissions critically explain how the vlunerability works. That is, when User A performs an AI search, Slack will search (1) his private channels (which presumably include his secret sensitive data) and (2) all public channels (which is where the bad guy User B is able to put a message that does the prompt injection), importantly including ones that User A has never joined and has never seen. That is, the only reason this vulnerability works is because User B is able to create a public channel but with himself as the only user so that it's highly unlikely anyone else would find it.
- paxys 2y agoYes, but that part isn't the vulnerability. That's how Slack search works. You get results from all public channels. It would be useless otherwise.
- Y-bar 2y agoOur workplace has a lot of public channels in the style of "Soccer" and "MLB" and "CryptoInvesting" which are useless to me and I have never joined any of them and do not want them at all in my search results. Yes, creating new public channels is generally a good feature to have. But it pollutes my search results, whether or not it is a key part of the security issue discussed. I have to click "Only my channels" so much it feels like I am playing Cookie Clicker, why can't I set it as checked by default?