Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

41–50 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#41

Post by tptacek »

llmslave2 wrote: post #22

This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k. If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending…

I don't think anybody in SFBA-style software development, both pre- and post-LLM, is really resilient against these kinds of attacks. The problem isn't vibe coding so much as it is multiparty DLL-hell dependency stacks, which is something I attribute more to Javascript culture than to any recent advance in technology.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#42

Post by tptacek »

padjo wrote: post #4

Seems like such a tiny amount of money for a bug that can be used to completely own your customers accounts. Also not much excuse for xss these days.

This comes up on every story about bug bounties. There is in general no market at all for XSS vulnerabilities. That might be different for Twitter, Facebook, Instagram, and TikTok, because of the possibility of monetizing a single strike across a whole huge social network, and there's maybe a bank-shot argument for Discord, but you really have to do a lot of work to generate the monetization story for any of those.

The vulnerabilities that command real dollars all have half-lives, and can't be fixed with a single cluster of prod deploys by the victims.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#43

Post by username223 »

dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

It's wild how often we rediscover that executing untrusted code leads to decades of whack-a-mole security. Excel/Word plus macros, HTML plus JavaScript, SVG plus JavaScript, ...

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#44

Post by aidenn0 »

dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

External entities in XML[1] were a similar issue back when everyone was using XML for everything, and parsers processed external-entities by default.

1: https://owasp.org/www-community/vulnerabilities/XML_External...

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#45

Post by tptacek »

azemetre wrote: post #33
vablings wrote: post #30

Earlier quoted context omitted.

Stupid, especially because he is a kid and young in his career. His lifetime earnings and ability to score a better paying job is worth way more than an extra couple thousand dollars selling this kind of exploit to criminals. It's why NDA's for security vulnerabilities are harmful because it doesn't allow a kind of social credit accumulation

Back in the day the US government would give you $20k-60k cash in a nice briefcase for this type of exploit. Just another thing big tech has ruined I suppose.

Can you cite a source for that claim? The USG paying mid-5-figures for an XSS vulnerability? That's news to me.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#46

Post by ascorbic »

finghin wrote: post #36
FloorEgg wrote: post #6

Earlier quoted context omitted.

Supply and demand I guess. Pathetic for a senior SE but pretty awesome for a 16 year old up and coming hacker.

I hope I'm not assuming too much but I'm really hope the up and coming hacker is smart enough to know that his work was worth more than $4,000. That's 1-2% of an annual SE salary for someone with similar skillset.

And this will help them land that six figure job

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#47

Post by tptacek »

charlesabarnes wrote: post #12
tuesdaynight wrote: post #7

Earlier quoted context omitted.

What is the reason for the low values? I would understand if it was a small company, but we are talking about Discord here.

Supply and demand. Selling via grey markets is an option, but many white hats don't go that route due to risk. There's plenty of people that will also find vulnerabilities without any money attached.

What "grey market" are you talking about? How specific can you be about it?

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#48

Post by MeetingsBrowser »

finghin wrote: post #36
FloorEgg wrote: post #6

Earlier quoted context omitted.

Supply and demand I guess. Pathetic for a senior SE but pretty awesome for a 16 year old up and coming hacker.

I hope I'm not assuming too much but I'm really hope the up and coming hacker is smart enough to know that his work was worth more than $4,000. That's 1-2% of an annual SE salary for someone with similar skillset.

> That's 1-2% of an annual SE salary for someone with similar skillset.

I agree $4,000 is way too low, but a $400k salary is really high, especially for security work.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#49

Post by hinkley »

aidenn0 wrote: post #44
dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

External entities in XML[1] were a similar issue back when everyone was using XML for everything, and parsers processed external-entities by default. 1: https://owasp.org/www-community/vulnerabilities/XML_External...

At least with external entities you could deny the parser an internet connection and force it to only load external documents from a cache you prepopulated and vetted. Turing completeness is a bullshit idea in document formats.
Post reply on HN