Activision, the publisher of computer games (including the Call of Duty franchise), reported a security breach that occurred back in early December 2022 through the corporate messenger Slack.

Let me remind you that we also wrote that Hackers compromised Slack private GitHub repositories, and also that Mirai Botnet RapperBot Conducts DDoS Attacks on Game Servers.

It turned out that hackers gained access to one of the company’s internal Slack channels and stole data, and the incident became publicly known only thanks to a report by Vx-underground security experts and media publications.

Vx-underground specialists posted on Twitter a number of edited screenshots received directly from the attackers. The screenshots, dated December 4, 2022, showcase Activision’s confidential working papers related to the Call of Duty franchise, as well as the content release schedule for the coming year, through November 17.

The researchers reported that the hack was carried out due to a successful phishing attack on one of the company’s employees. After that, the hackers penetrated the Activision Slack channel, and also tried to compromise other employees, but no one else fell for phishing.

Let me remind you that the media wrote that Russian Hackers Launched a Massive Spear-Phishing Campaign.

At the same time, Vx-underground emphasized that Activision generally kept silent about this attack.

Now, after numerous questions from the media, company representatives were forced to confirm the hack. At the same time, the company assures that the incident did not affect the source codes of the games and the personal data of the players.

At the same time, the company did not specify what kind of data the hackers still got access to (in addition to the content release schedule for Call of Duty).

The publication Insider Gaming, which claims to have received and analyzed this leak in its entirety, reports that among the stolen information there are full names, email addresses, phone numbers, salaries and other data of employees. Moreover, according to journalists, the compromised Activision employee works in the personnel department and has access to a large amount of confidential data.

The post Hackers Broke into Activision’s Slack and Stole Data appeared first on Gridinsoft Blog.

On December 31, while everyone was celebrating the New Year, Salesforce, the company behind the development of the corporate Slack messenger, published a message about the incident of compromising Slack repositories on GitHub.

Let me remind you that recently MI also wrote that Slack Is Resetting User Passwords Due to a Bug, and also that Slack Connect DM new feature drew a barrage of criticism.

The attack by unknown attackers affected some of the company’s private GitHub repositories, but it is reported that Slack’s core codebase and customer data were not affected.

Slack representatives write that the stolen tokens have already been invalidated, and the investigation of the “potential impact” of this attack on customers is still ongoing. So far, there has been no indication that hackers have gained access to any sensitive areas or Slack workspaces. However, as a precaution, the company has changed the relevant secrets.

At the same time, journalists drew attention to a number of oddities associated with the disclosure of data about this incident. Thus, Bleeping Computer notes that the message about the attack was published on December 31, when most people are busy celebrating the New Year.

In addition, the report was initially not displayed at all on the international version of the company’s blog, and in some regions (for example, in the UK), the publication was marked noindex, which is used to exclude web pages from search results and make them much more difficult to detect. However, Google successfully indexed a post for the US published without the noindex tag.

As a result, according to ArsTechnica, although the message about the incident appeared on the network as early as December 31, search engines and the Internet Archive practically “did not see” it until January 5-6. It seems that the Slack developers were trying to prevent this newsletter from being indexed by search engines and to limit the publicity of what happened.

Let me remind you that the media also wrote that Facebook incorporates hidden codes in photos for download.

The post Hackers compromised Slack private GitHub repositories appeared first on Gridinsoft Blog.

Let me remind you that we also wrote that ToTok messenger turned out to be a tool for total tracking, and also that UseCrypt Messenger developers filed a lawsuit against IS researcher for finding bugs.

The official announcement states that the mentioned bug was discovered and fixed in the Slack Shared Invite Link feature, which allows Slack Workspace owners to create special links. With such a link, anyone can join the conversation, and this feature was created as an alternative to inviting people one at a time.

Links created or revoked by users between April 17, 2017 and July 17, 2022 were found to expose their hashed passwords via web socket to all Slack-connected workspace members.

Slack also reminded that all users are encouraged to use multi-factor authentication, as well as install updates in a timely manner and use up-to-date anti-malware tools.

What to do if Slack resets your password?

The developers claim that all active accounts requiring a password reset receive direct notifications with instructions. For information about resetting your password, you can visit the Slack Help Center at any time.

The post Slack Is Resetting User Passwords Due to a Bug appeared first on Gridinsoft Blog.