If your connection passes the two tests above, then it’s likely that Slack is experiencing its own platform-wide outage, and you’ll have to wait until Slack resolves it. Slack also recommends checking your connection to its service by using its own connection test, which can be accessed at /help/test. Check your connection by attempting to load another website in your browser.

If you’re having trouble connecting to Slack, the first thing you need to do is check your own connection. It’s also possible that your connection issues could be on your end. And while there have been instances of the entire platform being down, connectivity issues don’t just stem from worldwide outages. One of the most common issues with Slack is connectivity. Looking at the functions, we can see an interesting one in protocol-link.ts module, which has the ability to change Slack app settings if clicked. I figured this may be an interesting attack vector, so with some grepping I found the area of code that processes these protocol links. As a Slack user, one feature that I was already familiar with was the support for “ slack://” hyperlinks. Slack is an Electron app, which makes reverse engineering quite easy for us. We will go over some interesting applications of this attack. This entire technique relied on how Slack treated clickable links and what was possible with certain slack:// links. While on the attacker’s server, the attacker could have not only stolen the document, but even inserted malicious code in it so that when opened by victim after download (through Slack application), their machine would have been infected. This could have allowed all future downloaded documents by the victim to end up being uploaded to an attacker owned file server until the setting is manually changed back by the victim. The vulnerability could have allowed a remote attacker to submit a masqueraded link in a slack channel, that “if clicked” by a victim, would silently change the download location setting of the slack client to an attacker owned SMB share. The vulnerability was reported to Slack via HackerOne based on our coordinated disclosure policy and Slack has patched this issue in one of its latest updates, v3.4.0. I’m going to go over an interesting feature abuse that could have been used to steal and even manipulate downloads from Slack users using the Slack desktop app on Windows.

Slack desktop windows 10