Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

201–210 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#201

Post by __float »

tick_tock_tick wrote: post #185
llmslave2 wrote: post #22

This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k. If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending…

The issue is everyone loves to have everything fronted by a single domain. Most of xss is because of this basic flaw. All of this could have been avoided if discord didn't run their API docs through discord.com

It's a bit surprising they did that, to be honest. I work at a similarly-sized, HN-popular tech company and our security team is very strict about less-trusted (third party!!) code running on another domain, or a subdomain at the very least, with strict CSP and similar.

But in the age of AI, it seems like chasing the popular thing takes precedence to good practices.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#202

Post by ex-aws-dude »

prmoustache wrote: post #137
throwaway613745 wrote: post #67

Ok, I’m never opening an svg ever again. Found by a 16 year old, what a legend.

Open it with a browser running inside a jail.

I tried that and they wouldn't let me bring my laptop in

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#203

Post by tptacek »

tuhgdetzhh wrote: post #162
tptacek wrote: post #146

Earlier quoted context omitted.

No it would not have been.

Could you elaborate on why not?

What 'arcwhite said (sorry, I got dragged into a call).

1. The exploits (not vulnerabilities; that's mostly not a thing) that command grey/black market value all have half-lives.

2. Those exploits all fit into existing business processes; if you're imagining a new business, one that isn't actively running right now as we speak (such as you'd have to do to fit any XSS in a specific service), you're not selling an exploit; you're planning a heist.

3. The high-dollar grey market services traffic exclusively in RCE (specifically: reliable RCE exploits, overwhelmingly in mainstream clientside platforms, with sharp dropoffs in valuation as you go from e.g. Chrome to the next most popular browser).

4. Most of the money made in high-ticket exploit sales apparently (according to people who actually do this work) comes on the backend, from tranched maintenance fees.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#204

Post by drewvlaz »

notnullorvoid wrote: post #196
jdsleppy wrote: post #178

Earlier quoted context omitted.

Doesn't stealing the cookies/token require a non-HTTP-only session cookie or a token in localstorage? Do you know that Discord puts their secrets in one of those insecure places, or was it just a guess? I believe if you always keep session cookies in secure, HTTP-only cookies, then you are more resilient to this attack. I interviewed frontend devs last year and was shocked how few knew about this stuff.

In general if a script can run, users sessions and more importantly passwords are at risk. It's true that an HTTP-only session cookie couldn't be directly taken, but it's trivial to present the user with a login screen and collect their password (and OTP), at which point you can easily get a session remotely. It can look entirely like the regular login page right down to the url path (because the script can modify th…

Wow did not realize a url could be set like that without promoting a page reload...

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#205

Post by tptacek »

wiether wrote: post #114
0xbadcafebee wrote: post #40

How these companies don't hire kids like Daniel for pennies on the dollar and have him attack their stacks on a loop baffles me. Pay the kid $50k/yr (part time, he still needs to go to school) to constantly probe your crappy stacks. Within a year or two you'll have the most goddamn secure company on the internet - and no public vulns to embarrass you.

That's a bit simplistic. If you sign a contract with a "hacker", then you are expecting results. Otherwise how do you decide to renew the contract next year? How do you decide to raise it next year? What if, during this contract, a vulnerability that this individual didn't found is exploited? You get rid of them? So you're putting pressure on a person who is a researcher, not a producer. Which is wrong. And also ther…

Just going to say here that people routinely engage pentest firms, several times annually, for roughly that sum of money, hoping but not expecting game-over vulnerabilities (and, from bitter experience as a buyer rather than a seller of those services over the last 5 years --- "no game-over vulnerabilities" is a very common outcome!)

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#206

Post by tptacek »

sammy2255 wrote: post #119
wiether wrote: post #114

Earlier quoted context omitted.

That's a bit simplistic. If you sign a contract with a "hacker", then you are expecting results. Otherwise how do you decide to renew the contract next year? How do you decide to raise it next year? What if, during this contract, a vulnerability that this individual didn't found is exploited? You get rid of them? So you're putting pressure on a person who is a researcher, not a producer. Which is wrong. And also ther…

They've already proved themselves as competent. $50k a year to a billion dollar company is nothing. Even if they find 0 vulnerabilities a year it's still worth it to them

I directionally agree with you but we could go another 20 comments deep on exactly what the purpose of an external pentest or red-team exercise is and how it might not match up perfectly with what an amateur web hacker is currently doing. But like: yeah, they could get into that business, at least until AI eats it.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#207

Post by FeepingCreature »

acheron wrote: post #181
ajross wrote: post #66

Earlier quoted context omitted.

Uh... Flash was a genuine firehose of security flaws. I mean, yeah, they patched them. So "battle tested security layer" isn't wrong in a technical sense. But, yikes, no.

The Flash revisionism I see around here occasionally is bizarre. No, Flash was terrible and killing it was good.

I think it depends on whether you see Flash as competing with webvideo or with downloadable executables.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#208

Post by IgorPartola »

dllu wrote: post #5

The fact that SVG files can contain scripts was a bit of a mistake. On one hand, the animations and entire interactive demos and even games in a single SVG are cool. But on the other hand, it opens up a serious can of worms of security vulnerabilities. As a result, SVG files are often banned from various image upload tools, they do not unfurl previews, and so on. If you upload an SVG to discord, it just shows the raw…

But how else would we revisit all the security bugs of Flash/Macromedia?

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#209

Post by bethekidyouwant »

JackSlateur wrote: post #39

I struggle to understand the issue .. could someone help me out ? Ok, you got " https://discord.com/_mintlify/_static/hackerone-a00f3c6c/lma... " to send a controlled payload But regular users will never hit " https://discord.com/_mintlify/_static/hackerone-a00f3c6c/lma... ", so they will never execute your script I fail to understand how this can be exploited, by whom and in what conditions

if you click on the link because it has discord.com in the domain the script in the SVG can (maybe) get your session data. Not actually sure if that’s true though, I suppose it depends on how the cookies are scoped

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#210

Post by [deleted] »

zffr wrote: post #122
Wowfunhappy wrote: post #118

Earlier quoted context omitted.

IMO, the bigger problem with SVGs as an image format is that different software often renders them (very) differently! It's a class of problem that raster image formats basically don't have.

I would have expected SVGs to be like PDFs and render the same across devices. Is the issue that some renderers don’t implement the full spec, or that some implement parts incorrectly?

[deleted]
Post reply on HN