Slack phishing attacks using webhooks

guest · Apr 16, 2020

Slack users could fall victim to mass phishing attacks
...researcher has discovered a loophole that enables phishing attacks on unsuspecting Slack channels
April 16, 2020
https://decrypt.co/25765/slack-users-could-fall-victim-to-mass-phishing-attacks

Popular messenger Slack has a big privacy issue, according to a cybersecurity researcher at AT&T Alien Labs. Per its latest report, published Tuesday, Slack is vulnerable to “webhook” attacks.
A webhook is a way for applications to exchange data in real-time via custom-generated URL addresses. The technology is growing in popularity lately because webhooks are resource-light, faster and more efficient than traditional programming interfaces.

Yet, researcher Ashley Graves discovered that webhooks could be used by malicious actors to send messages to multiple Slack channels—even without proper authorization. All they need to know is the channel’s webhook URL.

“Slack Incoming Webhooks allow you to post messages from your applications to Slack. By specifying a unique URL, your message body, and a destination channel, you can send a message to any webhook that you know the URL for in any workspace, regardless of membership,” the researcher warned.
She added that webhooks are typically considered a low-risk integration since hackers must select exactly what channel to target and are unable to receive any data—only to send it.
Click to expand...

AT&T Alien Labs: Slack phishing attacks using webhooks

[...]
Response from Slack 4/9/20:
Webhooks are credential tools that provide access to posting functionality within a workspace. Though data cannot be exposed through webhooks on Slack, we do recommend that workspace owners or admins invalidate publicly exposed webhook URLs and generate new ones.
To help Slack admins with that diligence, we proactively scrape GitHub for publicly exposed webhooks and invalidate them. Webhooks are safe as long as they remain secret since the webhook URL itself is unguessable. [...]
Click to expand...

Log in or Sign up

Slack phishing attacks using webhooks

guest Guest

Log in or Sign up

Slack phishing attacks using webhooks

guest Guest

Useful Searches