Slack and Microsoft Teams have some rather worrying security flaws
Third-party apps can be integrated with few security checks
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Slack andMicrosoftTeams, arguably the two biggest communications andonline collaborationplatforms around today, allow for the inclusion of hundreds of third-party apps, and that’s a security nightmare, experts have said.
Researchers at the University of Wisconsin-Madison argue that third-party apps rarely have their code reviewed by programmers atSlackand Microsoft. Even those that do, undergo a relatively superficial analysis, in which the reviewers analyze if the app works as intended, if it encrypts data, and run an automated scan that looks for vulnerabilities.
The rest just sits on the apps’ developers’ servers and freely integrates with Slack andMicrosoft Teams.
Major risks
With these platforms becoming the defactooperating systemsof corporate productivity, this is a major security risk, researchers claim.
“Slack and Teams are becoming clearinghouses of all of an organization’s sensitive resources,” Earlence Fernandes, one of the study’s authors, and a professor of computer science at the University of California at San Diego, said. “And yet, the apps running on them, which provide a lot of collaboration functionality, can violate any expectation of security and privacy users would have in such a platform.”
For the time being, Microsoft is keeping silent on the matter, until it is able to speak to the researchers more thoroughly.
Zoom’s answer to Slack is getting a new name and some new tools>Watch out, Zoom - Slack is here to eat your lunch>Check out the best firewalls right now
Slack, on the other hand, said it has a collection of approved apps that can be found in the Slack App Directory, and “strongly recommends” users install these apps, only, on theirendpoints. These, the company added, receive security reviews before inclusion, and are monitored for suspicious behavior.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Furthermore, Slack suggests IT admins configure their workspaces to allow users to install apps only with admin permission. “We take privacy and security very seriously and we work to ensure that the Slack platform is a trusted environment to build and distribute apps, and that those apps are enterprise-grade from day one,” the company concluded.
Via:Wired
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
7 myths about email security everyone should stop believing
Best Usenet client of 2024
VIPRE Security Group says its new endpoint protection tools can stamp out even the latest cybersecurity threats
