Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Application Security

Slack Forces Password Resets After Discovering Software Flaw

Workplace productivity software giant Slack on Friday forced password resets for a tiny fraction of its users after the discovery of a security flaw that exposed Slack credentials.

Slack’s security response team alerted users to the issue via email and followed up with a blog post warning about the risk of passwords leaking to a skilled attacker.

Workplace productivity software giant Slack on Friday forced password resets for a tiny fraction of its users after the discovery of a security flaw that exposed Slack credentials.

Slack’s security response team alerted users to the issue via email and followed up with a blog post warning about the risk of passwords leaking to a skilled attacker.

“We have no reason to believe that anyone was able to obtain your plaintext password because of this vulnerability. However, for the sake of caution, we have reset your Slack password,” the company told a fraction of its users.

According to official Slack documentation, the bug was discovered and fixed in Slack’s Shared Invite Link functionality, a feature that lets Slack workspace owners create a link that will permit anyone to join.  The feature is offered as an alternative to inviting people one-by-one via email to become workspace members. 

[ READ: Slack Offers Bigger Rewards for Serious Vulnerabilities ]

However, for users who created and/or revoked one of these links – Slack estimates it affects approximately 0.5% of users – between April 17, 2017 and July 17, 2022, Slack exposed a hashed password over the websocket to all users of the workspace who were currently connected to Slack.

From the Slack advisory:

“This hashed password was not visible in any Slack clients; discovering it required actively monitoring encrypted network traffic coming from Slack’s servers. This bug was discovered by an independent security researcher and disclosed to us on July 17, 2022.


Advertisement. Scroll to continue reading.

Upon receiving the report from the security researcher, we immediately fixed the underlying bug, and then began investigating the potential impact of this issue on our customers. We have no reason to believe that anyone was able to obtain plaintext passwords because of this issue. However, for the sake of caution, we have reset affected users’ Slack passwords.”

Slack is also using the incident to recommend that all users use multi-factor authentication technology and to ensure computer software and anti-malware security tools are updated.

The Salesforce-owned company is also recommending the use of new, unique passwords for every service and a password manager to help users avoid password reuse.

Related: New Slack Connect DM Feature Raises Security Concerns 

Related: Slack Offers Bigger Rewards for Serious Vulnerabilities

Related: Iran-Linked APT Abuses Slack in Attacks on Asian Airline

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...