Slack Hamburger Cheese Vulnerability

When a user types :hamburger: in order to display an emoji of a hamburger, a cheeseburger is instead displayed. Hamburgers do not have cheese on them. When a hamburger gains cheese, it becomes a cheeseburger. The two viable options to remediate, as far as I can see, are: 1) change the tag to :cheeseburger: 2) change the hamburger graphic so it no longer contains cheese. 1 attachment: Screen_Shot_2015-05-08_at_2.43.22_PM.png After extensive research, we have concluded this is indeed a security vulnerability in the Slack application. As we mapped out various scenarios, we realized there exists the potential for negative financial impact to the message sender. Consider the following scenario: Alice and Bob are going to lunch, and Bob has decided to buy Alice a hamburger to congratulate her on a promotion. Bob sends a message to Alice offering to purchase her a “hamburger” at :clock1230:. Unbeknownst to Bob and without his consent, Slack has just offered a cheeseburger as opposed to the aforementioned hamburger. A survey of local eating establishments has concluded that the mean price of adding cheese to a hamburger (colloquially: “with cheese”) is $.50. Given the delta between the price of a :hamburger: and :cheeseburger:, one might argue that the compound effect of this blunder could result in tens of dollars in losses across Slack’s userbase. We offer our sincere thanks, and are rewarding your finding with $12.50, which should be more than sufficient to purchase a reasonably priced hamburger or cheeseburger. Slack rewarded johnehdren with a $12.50 bounty.

A Slack message thread humorously treats the difference between a hamburger and a cheeseburger emoji as a serious security vulnerability. The exaggerated report invents a financial-loss scenario and ends with Slack awarding a tiny $12.50 bug bounty, parodying corporate security reports and vulnerability disclosure culture. EN: A Slack message thread humorously treats the difference between a hamburger and a cheeseburger emoji as a serious security vulnerability. The exaggerated report invents a financial-loss scenario and ends with Slack awarding a tiny $12.50 bug bounty, parodying corporate security reports and vulnerability disclosure culture.

• @infosecmemes / 267 2020-05-29