On December 31, while everyone was celebrating the New Year, Salesforce, the company behind the development of the corporate Slack messenger, published a message about the incident of compromising Slack repositories on GitHub.
Let me remind you that recently MI also wrote that Slack Is Resetting User Passwords Due to a Bug, and also that Slack Connect DM new feature drew a barrage of criticism.
The attack by unknown attackers affected some of the company’s private GitHub repositories, but it is reported that Slack’s core codebase and customer data were not affected.
Slack representatives write that the stolen tokens have already been invalidated, and the investigation of the “potential impact” of this attack on customers is still ongoing. So far, there has been no indication that hackers have gained access to any sensitive areas or Slack workspaces. However, as a precaution, the company has changed the relevant secrets.
At the same time, journalists drew attention to a number of oddities associated with the disclosure of data about this incident. Thus, Bleeping Computer notes that the message about the attack was published on December 31, when most people are busy celebrating the New Year.
In addition, the report was initially not displayed at all on the international version of the company’s blog, and in some regions (for example, in the UK), the publication was marked noindex, which is used to exclude web pages from search results and make them much more difficult to detect. However, Google successfully indexed a post for the US published without the noindex tag.
As a result, according to ArsTechnica, although the message about the incident appeared on the network as early as December 31, search engines and the Internet Archive practically “did not see” it until January 5-6. It seems that the Slack developers were trying to prevent this newsletter from being indexed by search engines and to limit the publicity of what happened.
Let me remind you that the media also wrote that Facebook incorporates hidden codes in photos for download.