【old men gay sex videos】

A security researcher has uncovered a flaw in Slack that could've been exploited to steal files over the business messaging app and old men gay sex videospotentially spread malware.

The flaw involves Slack's Windows desktop app, and how it can automatically send downloaded files to a certain destination—whether it be on your PC or to an online storage server. You can set a download location in the app's preferences section. However, David Wells, a researcher at the security firm Tenable, noticed there's another way to configure the option: Via a special link.

"Crafting a link like 'slack://settings/?update={ 'PrefSSBFileDownloadPath':'}' would change the default download location if clicked," Wells wrote in a blog post on the vulnerability.

Wells realized the same function could be abused. Imagine a hacker using the links to secretly reconfigure a Slack desktop app to send all downloaded files to an outside server. "Using this attack vector, an insider could exploit this vulnerability for corporate espionage, manipulation, or to gain access to documents outside of their purview," Well's security firm Tenable said in a separate report.

Mashable Light Speed Want more out-of-this world tech, space and science stories? Sign up for Mashable's weekly Light Speed newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up!

Original image has been replaced. Credit: Mashable

The vulnerability can also pave the way for potential malware infections. Any downloaded files sent to the hacker-controller server can be altered and booby-trapped to include malicious code. The attack will commence once the victim opens the file on the Slack desktop app.

The main obstacle of carrying out this attack is circulating the hacker-created links to people on Slack, which keeps its channels private to paying clients and their companies. To pull this off, Wells noticed how Slack channels can be configured to subscribe to RSS feeds, including threads on Reddit.

"I could make a post to a very popular Reddit community that Slack users around the world are subscribed to," Wells said. The hacker-created link will then populate inside the Slack channel and possibly attract some clicks.

"This technique could be unmasked by savvy Slack users, however if decades of phishing campaigns have taught us anything, it's that users click links, and when leveraged through an untrusted RSS feed, the impact can get much more interesting," he added.

Slack has patched the flaw in version 3.4.0 of the Windows desktop app. "We investigated and found no indication that this vulnerability was ever utilized, nor reports that our users were impacted," the company said in an email.

---

Featured Video For You

---

Chadwick Boseman tapped to play history's first black samurai

---

• Social Good
• Digital Culture
• Science
• Entertainment
• Deals
• Shopping
• Life
• Games

• Trump is feeling really, really under
• Fellow NFL players join Colin Kaepernick in National Anthem protest
• The 5G iPhone probably isn't coming until 2020
• Reese Witherspoon and Ariana Grande had a glorious Twitter exchange about 'thank u, next'
• The State of 5G: When It's Coming, How Fast It Will Be & The Sci
• Watch the world's happiest dog groomer boogie with a canine client
• Reese Witherspoon and Ariana Grande had a glorious Twitter exchange about 'thank u, next'
• Jake Gyllenhaal joins 'Spider
• Patched Desktop PC: Meltdown & Spectre Benchmarked
• Lena Dunham apologizes to Odell Beckham Jr. amid 'Lenny Letter' interview controversy

• Data scientist amid Facebook scandal didn't know of voter targeting
• 'Avengers: Infinity War' is the longest MCU movie, obviously
• 'Fantastic Beasts' actor fully settles that big plot hole controversy
• The 4th nor'easter in 3 weeks to hit Northeast at start of spring
• This student on a theme park ride has seen things you wouldn't believe
• Facebook's 'biggest ever data breach' left 50 million exposed in 2014
• Report: Trump plans sanctions on Venezuela's 'Petro' cryptocurrency
• Film academy president accused of sexual harassment
• VW will race its all
• Nimbus Data announces world's largest 3.5

• Insane wildfire photo perfectly sums up America in 2017
• There's more than one Hannukah song, y'all
• Wave of '90s throwback tours proves the nostalgia cycle is in full effect
• Fellow NFL players join Colin Kaepernick in National Anthem protest
• Best Sony deal: Save $100 on WH
• Microsoft's next browser might be based on Chromium
• UK lawmakers just released a trove of Facebook emails
• 'I Wish My Teacher Knew' offers moving insight into students' lives
• Mac Mini M2 Desktop deal: Save $100 at Best Buy
• Astronaut photos show what a rocket launch looks like from space

• Outdoor speaker deal: Save $20 on the Soundcore Boom 2
• NASA spacecraft OSIRIS
• Boomer Phelps is the real king of the pool in new Instagram video
• 'The Cher Show' on Broadway review: Should you Believe?
• Elon Musk breaks silence on stock plunge as Trump claims he'll buy a Tesla to help
• Don't bin them: You can mail back your used Nespresso coffee pods
• 'Friends' isn't leaving Netflix January 1
• Videos of tech being destroyed will set you free, if only for a few minutes
• Today's Hurdle hints and answers for May 5, 2025
• Spotify just released 2018's most streamed artists and yup, it's all dudes