Workplace productivity software giant Slack on Friday forced password resets for a tiny fraction of its users after the discovery of a security flaw that exposed Slack credentials.
Slack’s security response team alerted users to the issue via email and followed up with a blog post warning about the risk of passwords leaking to a skilled attacker.
“We have no reason to believe that anyone was able to obtain your plaintext password because of this vulnerability. However, for the sake of caution, we have reset your Slack password,” the company told a fraction of its users.
According to official Slack documentation, the bug was discovered and fixed in Slack’s Shared Invite Link functionality, a feature that lets Slack workspace owners create a link that will permit anyone to join. The feature is offered as an alternative to inviting people one-by-one via email to become workspace members.
[ READ: Slack Offers Bigger Rewards for Serious Vulnerabilities ]
However, for users who created and/or revoked one of these links – Slack estimates it affects approximately 0.5% of users – between April 17, 2017 and July 17, 2022, Slack exposed a hashed password over the websocket to all users of the workspace who were currently connected to Slack.
From the Slack advisory:
“This hashed password was not visible in any Slack clients; discovering it required actively monitoring encrypted network traffic coming from Slack’s servers. This bug was discovered by an independent security researcher and disclosed to us on July 17, 2022.
Upon receiving the report from the security researcher, we immediately fixed the underlying bug, and then began investigating the potential impact of this issue on our customers. We have no reason to believe that anyone was able to obtain plaintext passwords because of this issue. However, for the sake of caution, we have reset affected users’ Slack passwords.”
Slack is also using the incident to recommend that all users use multi-factor authentication technology and to ensure computer software and anti-malware security tools are updated.
The Salesforce-owned company is also recommending the use of new, unique passwords for every service and a password manager to help users avoid password reuse.
Related: New Slack Connect DM Feature Raises Security Concerns
Related: Slack Offers Bigger Rewards for Serious Vulnerabilities
Related: Iran-Linked APT Abuses Slack in Attacks on Asian Airline
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
More from Ryan Naraine
- Bankrupt IronNet Shuts Down Operations
- AWS Using MadPot Decoy System to Disrupt APTs, Botnets
- Progress Software Patches Critical Pre-Auth Flaws in WS_FTP Server Product
- Chinese Gov Hackers Caught Hiding in Cisco Router Firmware
- CISA Unveils New HBOM Framework to Track Hardware Components
- Gem Security Lands $23 Million Series A Funding
- New ‘Sandman’ APT Group Hitting Telcos With Rare LuaJIT Malware
- CrowdStrike to Acquire Application Intelligence Startup Bionic
Latest News
- Johnson Controls Ransomware Attack Could Impact DHS
- Unpatched Exim Vulnerabilities Expose Many Mail Servers to Attacks
- CISA Kicks Off Cybersecurity Awareness Month With New Program
- Recently Patched TeamCity Vulnerability Exploited to Hack Servers
- Silverfort Open Sources Lateral Movement Detection Tool
- Bankrupt IronNet Shuts Down Operations
- AWS Using MadPot Decoy System to Disrupt APTs, Botnets
- Generative AI Startup Nexusflow Raises $10.6 Million
