Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

131–140 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#131

Post by tptacek »

jonahx wrote: post #107
tptacek wrote: post #88

Earlier quoted context omitted.

That's not how any of this works. A price for a vulnerability tracking the worst-case outcome of that vulnerability isn't a bounty or a market-clearing price; it's a shakedown fee. Meanwhile: the actual market-clearing price of an XSS vulnerability is very low (in most cases, it doesn't exist at all) because there aren't existing business processes those vulnerabilities drop seamlessly into; they're all situational a…

> the actual market-clearing price of an XSS vulnerability is very low (in most cases, it doesn't exist at all) because there aren't existing business processes those vulnerabilities drop seamlessly into; they're all situational and time-sensitive. Could you elaborate on this? I don't fully understand the shorthand here.

I'm happy to answer questions but the only thing I could think to respond with here is just a restatement of what I said. I was terse; which part do you want me to expand on? Sorry about that!

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#132

Post by combyn8tor »

hinkley wrote: post #54

It’s clear to me now that I need to set up my home machine the way I set up BYOD when I was contracting last. I need a separate account for all of my development. I have a friend who at one point had five monitors and 2 computers (actually it might be 3) on his desk and maybe he’s the one doing it right. He keeps his personal stuff and his programming/work stuff completely separate.

I have three OS installs. Windows install for games. Another Windows for development (I have to for windows dev). And a Ubuntu install for anything not games/work. The windows drives use bitlocker and they can't access each other's files. It's not perfect.

Although with the amount of crap I have to install for windows development I'm starting to wonder if a base VM image that is used as a start point for each project would be cleaner.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#133

Post by snvzz »

superasn wrote: post #128

This is a pretty scary exploit, considering how easily it could be abused. Imagine just one link in a tweet, support ticket, or email: https://discord.com/_mintlify/static/evil/exploit.svg . If you click it, JavaScript runs on the discord.com origin. Here's what could happen: - Your Discord session cookies and token could be stolen, leading to a complete account takeover. - read/write your developer applications & we…

>the $4,000 bounty feels like a slap in the face.

And serves a reminder crime does pay.

In the black market, it would have been worth a bit more.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#134

Post by Dma54rhs »

gkoberger wrote: post #111
bri3d wrote: post #11

Proxying from the "hot" domain (with user credentials) to a third party service is always going to be an awful idea. Why not just CNAME Mintlify to dev-docs.discord.com or something? This is also why an `app.` or even better `tenant.` subdomain is always a good idea; it limits the blast radius of mistakes like this.

I run a product similar to Mintlify. We've made different product decisions than them. We don't support this, nor do we request access to codebases for Git sync. Both are security issues waiting to happen, no matter how much customers want them. The reason people want it, though, is for SEO: whether it's true or outdated voodoo, almost everyone believes having their documentation on a subdomain hurts the parent domai…

What makes you say that Google claims it's not true? Google claims subdomains are completely two different domains and you'll lose all the linking/page rank stuff according to their own docs regarding SEO. Some SEO gurus claim it's not so black and white but no one knows for sure. The data does show having docs on subdomain is more harmful to your SEO if you get linked to then a lot.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#135

Post by azemetre »

tptacek wrote: post #130
azemetre wrote: post #95

Earlier quoted context omitted.

The book "This Is How They Tell Me the World Ends" by Nicole Perlroth, while it's about the history of cyberweapons it does a very good job detailing the late 90s to early 2010s exploit market. I don't have it in front of me, but I'm talking about the "nobody but us" era of exploit markets: https://en.wikipedia.org/wiki/NOBUS Where the NSA seemingly was buying anything, even if not worthwhile, as a form of "munitions…

I haven't read her book, am myself somewhat read in to the background here, and if she's claiming NSA was stockpiling serverside web bugs, I do not believe her. In reality, intelligence agencies today don't even really stockpile mobile platform RCE. The economics and logistics are counterintuitive. Most of the money is made on the "backend", in support/update costs, paid in tranches; CNE vendors have to work hard to…

Maybe there is a misunderstanding, I'm not saying that the NSA would be buying XSS scripts. I'm saying that if this was 35 years ago the NSA would be buying exploits with common user software. Back then the exploits were "lesser" but there still was a market and not every exploit that was bought was a wonder of software engineering. Nowadays the targeted market is the web and getting exploits on some of the most used sites would be worthy of buying.

Kid was simply born in the wrong era to cash out easy money.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#136

Post by jijijijij »

tptacek wrote: post #127
jijijijij wrote: post #125

Earlier quoted context omitted.

> That's not how any of this works. Yes, evidently not. Just because on average the intelligence agencies or ransom ware distributors wouldn't pay big bucks for XSS on Zerodium etc. doesn't mean that's setting the fair, or wise price for disclosure. Every bug bounty program is mostly PR mitigation. It's bad PR if you underpay for a disclosed vulnerability, which may have ended your business, considering the price of…

Nobody is buying anything on "Zerodium".

I wasn't aware they are gone. It's not my game, replace with whatever shady exploit trader/market out there.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#138

Post by odensc »

bri3d wrote: post #11

Proxying from the "hot" domain (with user credentials) to a third party service is always going to be an awful idea. Why not just CNAME Mintlify to dev-docs.discord.com or something? This is also why an `app.` or even better `tenant.` subdomain is always a good idea; it limits the blast radius of mistakes like this.

Yep - this is the core issue that made the vulnerability so bad. And if you use a subdomain for a third-party service, make sure your main app auth cookies are scoped to host-only. Better yet, use a completely different domain like you would for user-generated content (e.g. discorddocs.com).

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#139

Post by Sohcahtoa82 »

jonahx wrote: post #97
Shared404 wrote: post #60

Earlier quoted context omitted.

PDF also has script support unfortunately.

Does that mean that opening arbitrary pdfs on your laptop is unsafe?

Let me put it this way...

In one of my penetration testing training classes, in one of the lessons, we generated a malicious PDF file that would give us a shell when the victim opened it in Adobe.

Granted, it relied on a specific bug in the JavaScript engine of Adobe Reader, so unless they're using a version that's 15 years old, it wouldn't work today, but you can't be too cautious. 0-days can always exist.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#140

Post by gkoberger »

Dma54rhs wrote: post #134
gkoberger wrote: post #111

Earlier quoted context omitted.

I run a product similar to Mintlify. We've made different product decisions than them. We don't support this, nor do we request access to codebases for Git sync. Both are security issues waiting to happen, no matter how much customers want them. The reason people want it, though, is for SEO: whether it's true or outdated voodoo, almost everyone believes having their documentation on a subdomain hurts the parent domai…

What makes you say that Google claims it's not true? Google claims subdomains are completely two different domains and you'll lose all the linking/page rank stuff according to their own docs regarding SEO. Some SEO gurus claim it's not so black and white but no one knows for sure. The data does show having docs on subdomain is more harmful to your SEO if you get linked to then a lot.

Here's the argument for/against it: https://www.searchenginejournal.com/ranking-factors/subdomai...

I think the answer likely is quite nuanced, for what it's worth.

Post reply on HN