This, and especially #3.
Having the same cookie used on a different computer should be the reddest flag of them all. This could be identified by the user agent (different version of the Slack client) and a different IP (cookie accessed from a different country than it was originally created).
Session invalidation time is someting the slack admin (That is, EA in this case) configures themself.
Fun fact, if you want SSO for your Slack, you have to pay extra unless you are already using one of the top tier Slack editions. So either pay up, or have multiple ways of administering your users, with the security implications that causes.
Re:Hackers used Slack to break into EA Games
by whydoyoucare on Friday June 11, 2021 @05:24PM
(#27478688)
I've rarely seen any enterprise Slack ever configured for session timeouts. Misplaced trust on the employee device combined with convenience over security.
1) Slack does not invalidate sessions after a short enough period of time or inactivity (for a cookie to make it to another site, be purchased and used, probably takes some time).
2) Slack does not properly terminate sessions on logout or inactivity (allowing cookies to be reused after logout).
3) Slack is not using any more clever techniques to make cookies useless to attackers.