【This Ain't Avatar XXX Porn Parody】

A security researcher has uncovered a flaw in Slack that could've been exploited to steal files over the business messaging app and This Ain't Avatar XXX Porn Parodypotentially spread malware.

The flaw involves Slack's Windows desktop app, and how it can automatically send downloaded files to a certain destination—whether it be on your PC or to an online storage server. You can set a download location in the app's preferences section. However, David Wells, a researcher at the security firm Tenable, noticed there's another way to configure the option: Via a special link.

"Crafting a link like 'slack://settings/?update={ 'PrefSSBFileDownloadPath':'}' would change the default download location if clicked," Wells wrote in a blog post on the vulnerability.

Wells realized the same function could be abused. Imagine a hacker using the links to secretly reconfigure a Slack desktop app to send all downloaded files to an outside server. "Using this attack vector, an insider could exploit this vulnerability for corporate espionage, manipulation, or to gain access to documents outside of their purview," Well's security firm Tenable said in a separate report.

Mashable Light Speed Want more out-of-this world tech, space and science stories? Sign up for Mashable's weekly Light Speed newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up!

Original image has been replaced. Credit: Mashable

The vulnerability can also pave the way for potential malware infections. Any downloaded files sent to the hacker-controller server can be altered and booby-trapped to include malicious code. The attack will commence once the victim opens the file on the Slack desktop app.

The main obstacle of carrying out this attack is circulating the hacker-created links to people on Slack, which keeps its channels private to paying clients and their companies. To pull this off, Wells noticed how Slack channels can be configured to subscribe to RSS feeds, including threads on Reddit.

"I could make a post to a very popular Reddit community that Slack users around the world are subscribed to," Wells said. The hacker-created link will then populate inside the Slack channel and possibly attract some clicks.

"This technique could be unmasked by savvy Slack users, however if decades of phishing campaigns have taught us anything, it's that users click links, and when leveraged through an untrusted RSS feed, the impact can get much more interesting," he added.

Slack has patched the flaw in version 3.4.0 of the Windows desktop app. "We investigated and found no indication that this vulnerability was ever utilized, nor reports that our users were impacted," the company said in an email.

---

Featured Video For You

---

Chadwick Boseman tapped to play history's first black samurai

---

• Games
• Shopping
• Entertainment
• Digital Culture
• Life
• Social Good
• Deals
• Science

• Blockchain Explained: How It Works, Who Cares and What Its Future May Hold
• 12 meme costume ideas for Halloween 2019
• Apple HomePod 2 unveiled with a faster chip and better sound quality
• Bruley, the famous 'Queer Eye' French bulldog, has died
• Blockchain Explained: How It Works, Who Cares and What Its Future May Hold
• Netflix's password sharing crackdown is finally happening early 2023
• If you love 'Traitors,' you should play these games
• This Italian translator can't believe her ears translating Trump
• Greenpeace activists charged after unfurling 'Resist' banner at Trump Tower in Chicago
• Tim Cook on Hong Kong protest app removal: We did it to protect our users

• Cheeky sunbathing seal is a literal traffic stopper and locals kind of love it
• Just try not to cry watching the 10 most
• The 'Om Telolet Om' meme has a bizarre origin
• A prominent climate scientist just won a major court battle
• 11 tips for pooping at work when someone's in the next stall
• India's largest mobile wallet app disappears from the App Store
• This runner is using Strava to create delightfully festive patterns
• Ikea is not OK with you sleeping over in its stores
• 11 terrible beauty trends from 2016 that need to die
• Man's penis

• Wordle today: The answer and hints for January 28, 2025
• The presidential candidates sure use a lot — a whole lot — of em dashes
• Watch Olympic divers flawlessly take on the 'Avengers' pool challenge
• This year's PSAT memes are here to anger the College Board
• SpaceX is so close to turning its rocket headquarters into an actual city
• Don't use any THC vaping product, FDA warns
• Jennifer Coolidge just joined TikTok in the best possible way
• AmazonSmile ending: Amazon is shutting down the charity program
• AC Milan vs. Feyenoord 2025 livestream: Watch Champions League for free
• There's a Pornhub for everything in this new rhyming meme

• Donald Trump talked about space and Buzz Aldrin's face says it all
• Rihanna strutting in slow motion while smoking a joint is a sight to behold
• Samsung's new invention could usher in a very different foldable phone
• President Trump just literally begged us to impeach him
• Then and Now: Six Generations of $200 Mainstream Radeon GPUs Compared
• Twitter Blue with an ad
• Apple's 14
• 12 Keanu Reeves characters to dress as this Halloween
• They met on Tumblr, and their relationship outlasted their accounts
• All hail the 2 best Halloween tweets of all time