【headmaster: consensual eroticism for lovers of literature】

A security researcher has uncovered a flaw in Slack that could've been exploited to steal files over the business messaging app and headmaster: consensual eroticism for lovers of literaturepotentially spread malware.

The flaw involves Slack's Windows desktop app, and how it can automatically send downloaded files to a certain destination—whether it be on your PC or to an online storage server. You can set a download location in the app's preferences section. However, David Wells, a researcher at the security firm Tenable, noticed there's another way to configure the option: Via a special link.

"Crafting a link like 'slack://settings/?update={ 'PrefSSBFileDownloadPath':'}' would change the default download location if clicked," Wells wrote in a blog post on the vulnerability.

Wells realized the same function could be abused. Imagine a hacker using the links to secretly reconfigure a Slack desktop app to send all downloaded files to an outside server. "Using this attack vector, an insider could exploit this vulnerability for corporate espionage, manipulation, or to gain access to documents outside of their purview," Well's security firm Tenable said in a separate report.

Mashable Light Speed Want more out-of-this world tech, space and science stories? Sign up for Mashable's weekly Light Speed newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up!

Original image has been replaced. Credit: Mashable

The vulnerability can also pave the way for potential malware infections. Any downloaded files sent to the hacker-controller server can be altered and booby-trapped to include malicious code. The attack will commence once the victim opens the file on the Slack desktop app.

The main obstacle of carrying out this attack is circulating the hacker-created links to people on Slack, which keeps its channels private to paying clients and their companies. To pull this off, Wells noticed how Slack channels can be configured to subscribe to RSS feeds, including threads on Reddit.

"I could make a post to a very popular Reddit community that Slack users around the world are subscribed to," Wells said. The hacker-created link will then populate inside the Slack channel and possibly attract some clicks.

"This technique could be unmasked by savvy Slack users, however if decades of phishing campaigns have taught us anything, it's that users click links, and when leveraged through an untrusted RSS feed, the impact can get much more interesting," he added.

Slack has patched the flaw in version 3.4.0 of the Windows desktop app. "We investigated and found no indication that this vulnerability was ever utilized, nor reports that our users were impacted," the company said in an email.

---

Featured Video For You

---

Chadwick Boseman tapped to play history's first black samurai

---

• Entertainment
• Science
• Digital Culture
• Shopping
• Life
• Deals
• Tech
• Games

• Blockchain Explained: How It Works, Who Cares and What Its Future May Hold
• Musetti vs. Diallo 2025 livestream: Watch Madrid Open for free
• Useful or Little Known Android Features
• 'Thunderbolts*' mid
• Chiefs vs. Texans 2025 livestream: Watch NFL Playoffs for free
• The Story Behind the Home of Forgotten Video Games
• Get the official Atari 7800+ Console for 50% off
• Best Kindle Unlimited deal: Get 3 months of Kindle Unlimited for 99 cents
• VidCon 2025: Creators share their mistakes and lessons learned
• Analyzing Graphics Card Pricing: May 2018

• Top YouTube clips of 2016 prove this country wishes it was the 51st state
• Adobrable bush baby inspires super
• Fans are petitioning to bring back 'Good Girls Revolt'
• People are pissed about the sexist and ageist reaction to Madonna twerking
• Female journalist has defiant response to troll publishing nude photos of her
• India built the world's largest solar plant in just eight months
• GE integrates Alexa into its first desk lamp
• The internet is rallying to help fund this dog's facelift
• NYT Connections Sports Edition hints and answers for June 18: Tips to solve Connections #269
• Why not try on this costume made of human teeth?

• NYT Connections hints and answers for February 1: Tips to solve 'Connections' #601.
• Best Samsung deal: Save $60 on 64GB Samsung Galaxy Tab A9
• Today's Hurdle hints and answers for April 23, 2025
• NYT Strands hints, answers for May 1
• Brest vs. PSG 2025 livestream: Watch Champions League for free
• NYT Strands hints, answers for April 14
• Galaxy S9+ vs Pixel 2 XL Camera
• Trump's new tariff plan spares some smartphones, laptops
• Ruggable x Jonathan Adler launch: See the new designs
• Anker raises Amazon prices amid US tariffs

• How to unblock Xnxx for free
• Alienware M16 Gaming Laptop deal: Save $560
• The Story Behind the Home of Forgotten Video Games
• Trump signs AI education order to train K
• The 12 Best Games on the iPhone
• NYT Connections Sports Edition hints and answers for April 17: Tips to solve Connections #206
• The Made in America iPhone: How much would it cost?
• Trump's new tariff plan spares some smartphones, laptops
• Lehecka vs. Dimitrov 2025 livestream: Watch Brisbane International for free
• Best headphone deal: Take 22% off the Sonos Ace at Amazon