- The CyberNews team finds a flush tool for online data
- Gitlab Communications and Slack Bude Conversations are in the course of exhibition
- The company has been informed, but has not yet reacted
Cybersecurity researchers have discovered that an AI tool for Slack is leaking private user data, including chat messages and other communications.
The tool is called Struct Chat and is designed to improve productivity in Slack. It offers features such as the organization and summary of the wires, the answer to questions and the generation of newsletters, and costs $ 29.95 per month.
In mid-October 2024, the Cyberness Researchers found an “unprotected web service belonging to the company” in streaming user data. The exposed instance was an Apache Kafka broker, a messages distributed in real time.
Take appropriate measures
As researchers have explained, this platform acted as a central center to move data between different applications. As such, it manages large amounts of data and is a popular target.
“When observing the data flow for a brief period, we encountered examples of Gitlab Commites, Slack Buddle conversations and other services. This allows threat actors to follow and read messages and other events in real time and extract sensitive companies and personal information without any constraints, “said the researchers.
Here is the full list of information on display:
- Tokens, IDS, first names and family
- E-mail addresses
- Conversations with other users and the AI bot, horoding
- Internal team names and other general information
- Data and types of events (what the user does, for example, updating the Slack profile)
- Links to pipelines, internal URLs, CD / CI statutes (continuous integration and continuous deployment)
Alternatively, the company that developed this tool, also called Struct Cat, was informed of conclusions several times. However, on January 27, the flight has not yet been discussed.
“In one hour, the unprotected body has transmitted data from more than 1,000 unique users of 200 unique companies. This leak can easily be used to collect personally identifiable information from users, such as complete names, email addresses, cats and other internal communications, various links and internal resources, “concluded cybernews researchers, urging all Users to be careful and “take care of action”.
Via Cyberness
