Developers at major businesses who build apps for the instant-messaging platform Slack have unwittingly exposed key information like chat logs, direct messages, and passwords by recklessly sharing their programs in public.
The affected businesses include a major auditing firm, payments companies, a global advertising agency, and healthcare providers, according to research by Detectify, a security company that discovered the problem.
Developers have been including authentication devices called tokens, used to build Slack apps such as chat bots, when they publish their programs on GitHub, a popular code-sharing platform. ”Using the tokens it’s possible to eavesdrop on a company. Outsiders can easily gain access to internal chat conversations, shared files, direct messages and even passwords to other services if these have been shared on Slack,” Detectify wrote in a blog post explaining the vulnerability.
Slack has been a messaging sensation since it launched in 2013. It has 2.3 million daily active users, with NASA’s Jet Propulsion Lab, Ogilvy, and Harvard University among them. It’s also been pushing developers to build more bots in order to make its platform more useful to its customers. It has set aside $80 million, along with contributions from its own investors, for applications and bots on its platform. It has 45 bots listed in its app directory.
To make it easy for developers to build bots and other apps, Slack, like other popular platforms, issues them with a tool called tokens so that it can identify and authenticate a particular bot or app. These tokens just look like a string of letters and numerals, like:
xoxp-746925472-2946592639562856439
xoxb-123456789-123456789-123456789-123456
These tokens should be kept private, but developers sometimes skip a crucial step in securing them when they share their code in public. Instead of writing the actual tokens in their code, developers should hide those credentials behind an “environment variable,” which allows them to share the code without exposing any sensitive data.
It turns out that lots of developers building Slack apps didn’t do that. Searching for a Slack token by its prefix on GitHub immediately yielded a half dozen examples. That’s exactly what Detectify did, and it found 1,500 tokens on the platform.
To be clear, this sort of thing happens regularly. For example, inadvertantly published keys to Amazon Web Services can be found on GitHub, too. Arun Thampi, founder of Nestor, a bot-making platform for Slack, says engineers who make this mistake are simply being sloppy. “Slack can do better in educating people about tokens, but ultimately, developers are responsible for robust security practices, and committing your secrets to version-control is a very bad practice,” he said.
But it’s not simply about careless programmers, says Rickard Carlsson, Detectify’s chief executive. He says that Slack gives tokens a relatively high default level of access, meaning that developers probably didn’t realize just how much data could be extracted from their malicious use. “If you create a small funny bot, you don’t expect that someone can then scrape your credentials and use them to hack your accounts. It’s an awareness problem,” he said.
The tokens’ powerful access rights underscores Slack’s need to balance convenience for developers with security for their users. “Slack wants to make it easy for you to build bots and generate tokens,” Carlsson said. “They could make it super hard, but that wouldn’t benefit anyone.”
Detectify found the problem and reported it to Slack on March 26. Slack disabled the tokens Detectify found and searched for others. Slack said it has notified the affected groups. Neither Detectify nor Slack would identify any of the affected businesses. Slack said it has been clear that developers should never share tokens, but that it would now change its documentation and communication so this can be ”urgently expressed.”