So Slack's VoIP uses WebRTC, which connects via UDP/TCP to always send SRTP packets through a TURN proxy (which extends STUN via ICE) to work around usual NAT problems. These guys scanned the TURN and found an SSRF which allowed them to connect to Slack's VPC on AWS using IAM temporary credentials. Interesting.
For fun, read that last paragraph out loud to a non-techy near by and watch their eyes...
For fun, read that last paragraph out loud to a non-techy near by and watch their eyes...