Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

31–40 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#31

Post by azemetre »

da_grift_shift wrote: post #17
padjo wrote: post #4

Seems like such a tiny amount of money for a bug that can be used to completely own your customers accounts. Also not much excuse for xss these days.

>Also not much excuse for xss these days. XSS is not dead, and the web platforms mitigations (setHTML, Trusted Types) are not a panacea. CSP helps but is often configured poorly. So, this kind of widespread XSS in a vulnerable third party component is indeed concerning. For another example, there have been two reflected XSS vulns found in Anubis this year, putting any website that deploys it and doesn't patch at risk…

Is it really fair to compare an open source project that desperately wants only $60k a year to hire a dev with companies that have collectively raised over billions of dollars in funding?

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#32

Post by fainpul »

dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

"The script doesn't run unless the file is directly opened (you can't run scripts from ()."

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#33

Post by azemetre »

vablings wrote: post #30
ddtaylor wrote: post #10

$11k in bounties. Might have got more from the onion.

Stupid, especially because he is a kid and young in his career. His lifetime earnings and ability to score a better paying job is worth way more than an extra couple thousand dollars selling this kind of exploit to criminals. It's why NDA's for security vulnerabilities are harmful because it doesn't allow a kind of social credit accumulation

Back in the day the US government would give you $20k-60k cash in a nice briefcase for this type of exploit. Just another thing big tech has ruined I suppose.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#34

Post by lrvick »

I run an infosec firm and we have done attacks like this on my clients over and over and over in audits. I always say any bored teen could do most of what we do because most companies are moving too fast feature farming to have any time for responsible security hardening, and now I have yet another great citation.

Unfortunately a competitive rate agreed to in advance with a company before we do any pentesting is the only way we have ever been able to get paid fairly for this sort of work. Finding bugs in the wild as this researcher did often gets wildly underpaid relative to the potential impact of the bug, if they pay or take it seriously at all.

These companies should be ashamed paying out so little for this, and it is only a matter of time before they insult the wrong researcher who decides to pursue paths to maximum profit, or maximum damage, with a vuln like this.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#35

Post by JoshTriplett »

FeepingCreature wrote: post #16
dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

If only there was a widely used vector format that had script support and also decades of work on maintaining a battle-tested security layer around it with regular updates on a faster release cycle than your browser. That'd be crazy. Sure would suck if we killed it because we didn't want to bother maintaining it anymore. (Yes I'm still salty about Flash.)

> because we didn't want to bother maintaining it anymore

That wasn't the only reason. Flash was also proprietary, and opaque, and single-vendor, among many other problems with it.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#36

Post by finghin »

FloorEgg wrote: post #6
normie3000 wrote: post #2

Cool bug. Bug bounty money is pathetic.

Supply and demand I guess. Pathetic for a senior SE but pretty awesome for a 16 year old up and coming hacker.

I hope I'm not assuming too much but I'm really hope the up and coming hacker is smart enough to know that his work was worth more than $4,000. That's 1-2% of an annual SE salary for someone with similar skillset.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#37

Post by finghin »

tuesdaynight wrote: post #8
FloorEgg wrote: post #6

Earlier quoted context omitted.

Supply and demand I guess. Pathetic for a senior SE but pretty awesome for a 16 year old up and coming hacker.

You are right, but that could (probably not) make them go for the bad route because they would get way more money that way. 4k for a bug that could take control of your customer account sounds disrespectful to me.

Yeah, my read is that the teenage hacker confronted with this ridiculous payslip sees two ways forward: accept the pay cut for the CV benefit of working with bug bounties, or get a bit better at hiding your ass and make them really pay.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#38

Post by pverheggen »

bluetidepro wrote: post #28

Slightly related, as someone who doesn’t engage in this type of work, I’m curious about the potential risks associated with discovering, testing, and searching for security bugs. While it’s undoubtedly positive that this individual ultimately became a responsible person and disclosed the information, what if they hadn’t? Furthermore, on Discord’s side, what if they were unaware of this person and encountered someone…

> Furthermore, on Discord’s side, what if they were unaware of this person and encountered someone attempting to snoop on this information, mistakenly believing them to be up to no good?

Companies will create bug bounty programs where they set ground rules (like no social engineering), and have guides on how to identify yourself as an ethical hacker, for example:

https://discord.com/security

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#39

Post by JackSlateur »

I struggle to understand the issue .. could someone help me out ?

Ok, you got "https://discord.com/_mintlify/_static/hackerone-a00f3c6c/lma..." to send a controlled payload

But regular users will never hit "https://discord.com/_mintlify/_static/hackerone-a00f3c6c/lma...", so they will never execute your script

I fail to understand how this can be exploited, by whom and in what conditions

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#40

Post by 0xbadcafebee »

How these companies don't hire kids like Daniel for pennies on the dollar and have him attack their stacks on a loop baffles me. Pay the kid $50k/yr (part time, he still needs to go to school) to constantly probe your crappy stacks. Within a year or two you'll have the most goddamn secure company on the internet - and no public vulns to embarrass you.
Post reply on HN