Re:Remote Code Execution in Slack desktop apps
by jsploit on Saturday August 29, 2020 @02:13PM
(#24318182)
The authenticated one-click social engineering aspect of this significantly lowers exploit probability and overall risk.
[ Parent
| on HN ]
Re:Remote Code Execution in Slack desktop apps
by justsomeuser on Saturday August 29, 2020 @02:37PM
(#24318391)
This is true, but this attack could work in an Iframe in the background without that click. An attacker could buy a popular blog on the note taking app, and run the Iframe in the background collecting data for years. The bug was at least 5 years old.