Snynet Solution Logo
MON - SUN: 10 AM - 6 PM
+60 11 5624 8319

Blog

Slack paid a researcher next to nothing for uncovering a critical security bug

Image Description

Even large organizations often need help finding vulnerabilities in their software and services which is why many either start their own bug bounty programs or partner with the bug bounty platform HackerOne to do so.

Security researchers expect to be paid for their work and some have even become millionaires for finding critical vulnerabilities that could have serious repercussions for businesses if they were to be exposed online. 

However, a security researcher who recently disclosed multiple vulnerabilities to Slack, which could have allowed an attacker to take over a user's computer, only received $1,750 from the company valued at close to $20bn.

Security engineer Oskars Vegeris from Evolution Gaming privately shared extensive details on the vulnerabilities he discovered in a detailed write-up to Slack back in January of this year. If exploited, these bugs would have allowed an attacker to upload a file and share it with another Slack user or channel to take over a victim's computer. 

Critical vulnerabilities

Vegeris provided further details on the vulnerabilities he discovered in a HackerOne report that was recently made public at his request, saying:

“With any in-app redirect - logic/open redirect, HTML or javascript injection it's possible to execute arbitrary code within Slack desktop apps. This report demonstrates a specifically crafted exploit consisting of an HTML injection, security control bypass and a RCE Javascript payload. This exploit was tested as working on the latest Slack for desktop (4.2, 4.3.2) versions (Mac/Windows/Linux).”

According to the report, Vegeris showed multiple ways in which Slack apps could be exploited to achieve arbitrary code execution on a user's computer. He even went as far as to make a Proof-of-Concept (PoC) exploit video show just how easy it would be for a hacker to exploit these bugs if they were left unpatched.

Vegeris himself wasn't happy for receiving just $1,750 for disclosing multiple bugs and neither was the rest of the security community. However, the payments he received were in line with rewards detailed on Slack's HackerOne page.

Chief security officer at Slack, Larkin Ryder has since apologized to Vegeris on the company's HackerOne page after a blog post was published detailing his work without credit, which has since been fixed, saying:

“I am writing to convey very sincere apologies for any oversight in crediting your work. We very much appreciate the time and effort you've invested in making Slack safer. While the security team didn't author this blog post and the author has no visibility to your work in H1, we should make the extra steps to ensure all who contributed to improvement efforts in this area are recognized. I will investigate making appropriate updates to our blog post. Brandon will followup to ensure those updates are to your satisfaction and to coordinate your disclosure request. Again, I am very sorry for any misstep on our part.”

Via BleepingComputer

Date

31 Aug 2020

Sources


Share


Other Blog

  • Instagram will tell teens to take a break – after second Facebook outage forces them to

    Instagram is set to start nudging teenagers to "take a break" from the social media platform, in a small acknowledgement of the psychological impact the Facebook-owned app can have on young people.

    The app is set to add a number of new features designed to assist negatively-affected users, which Facebook's VP of Global Affairs Nick Clegg said should make "a considerable difference" in an interview on CNN.

    Clegg clarified that Instagram would "nudge" users to look at different content if they were "looking at the same content over and over again, and it's content which may not be conducive to their well being" – as well as even asking younger users to step away from the platform temporarily where needed.

    It's something of a turnaround for Facebook, which has now paused its plans for a child-focused version of Instagram, in the wake of whistleblower Frances Haugen – who blew the lid off internal Facebook research around Instagram's impact on teens' mental health, and which wasn't acted on until now.

    Of course, Facebook and its connected platforms – Instagram, Whatsapp, Oculus – have had issues even staying live in recent weeks.

    In early October a massive global outage saw everything from Facebook's social media services to the door passes used by Facebook employees stop working – and it was followed by a shorter outage over October 8 that stopped users from accessing the likes of Instagram for several hours, reportedly down to an entirely different technical issue (via BBC).

    During these outages, users flocked to other social platforms such as Twitter, or the Signal messaging app, which suggests not everyone is taking the opportunity to "take a break", though.

    Breaking with tradition

    While small nudges and measures like these can have an impact, they also pale in comparison to the scale of the problem, or the built-in incentives towards 'doomscrolling' endlessly through news feeds.

    Even asking teens to take a break is limited in its usefulness. The problem is that social media apps are often construed as how we take a break – from our work monitors, our chatting peers, our arguing relatives, the boredom of waiting for a bus. It's a permanently-available distraction, and pushing for teens to 'take a break' now and again, while a necessary step, can't fully counteract this problem by itself.

    Back in May 2021, Instagram introduced a way to hide like counts entirely – and we're going to need more instances like these of the service critically assessing its own mechanisms, rather than simply suggesting users close the app every once in a while.

    Via The Verge

    Read More
  • Using centralized monitoring to manage large IT environments

    Managing the monitoring, resilience and complexity of a large IT environment can be a real challenge. Centralized monitoring can help to achieve this.

    Read More
  • Best Ultrabooks in the UAE for 2021: the top thin and light laptops reviewed

    We've put together a definitive list of the best Ultrabooks, or thin and light Windows laptops.

    Read More
  • Microsoft could be planning on unleashing ‘the new Windows’ soon

    It’s unclear what ‘the new Windows’ might be, but it seems a good bet that it’s Microsoft’s fresh lightweight take on the OS.

    Read More

Find Out More About Us

Want to hire best people for your project? Look no further you came to the right place!

Contact Us