Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

371–380 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#371

Post by fireant »

macNchz wrote: post #165
tptacek wrote: post #41

Earlier quoted context omitted.

I don't think anybody in SFBA-style software development, both pre- and post-LLM, is really resilient against these kinds of attacks. The problem isn't vibe coding so much as it is multiparty DLL-hell dependency stacks, which is something I attribute more to Javascript culture than to any recent advance in technology.

I do occasionally wonder how different things would be if JavaScript had come with a very robust standard library from early on.

I also wonder about it recently. Also in regards to Rust which is hailed as the great savior but has the same, minimal, approach to standard library and needs loads of dependencies.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#372

Post by collinmanderson »

llmslave2 wrote: post #258
rainonmoon wrote: post #235

Earlier quoted context omitted.

XSS is categorically not an RCE and my point is that mitigations exist which make "It allows you to run any action as if you were the owner of the account" an unwarranted assumption. The writeup shows that it's possible to pop an alert box. That doesn't tell you anything about what's actually possible. Obviously Discord got enough information to take it seriously, but extrapolating that to suggest every third-party u…

How is XSS not remote code execution? You can do anything, from send fetch requests to the server with full credentials to loggging keystrokes or even open a tunnel and eval payloads... Anything the user can do, you can do via an XSS attack.

Generally code execution within browser/client-side javascript sandbox is just "XSS".

RCE usually implies server-side code execution (or breaking out of browser sandbox).

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#373

Post by collinmanderson »

selfmodruntime wrote: post #324
jdsleppy wrote: post #178

Earlier quoted context omitted.

Doesn't stealing the cookies/token require a non-HTTP-only session cookie or a token in localstorage? Do you know that Discord puts their secrets in one of those insecure places, or was it just a guess? I believe if you always keep session cookies in secure, HTTP-only cookies, then you are more resilient to this attack. I interviewed frontend devs last year and was shocked how few knew about this stuff.

Token stealing hasn't been a real danger for a decade now. If you don't mark your token's as non-HTTP you're doing something explicitely wrong, because 99% of backends nowadays do this for you.

with http-only they can't _steal_ the cookie, but they can still _use_ the cookie. It reduces the impact but doesn't fully solve it.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#374

Post by collinmanderson »

ddlsmurf wrote: post #190
jdsleppy wrote: post #178

Earlier quoted context omitted.

Doesn't stealing the cookies/token require a non-HTTP-only session cookie or a token in localstorage? Do you know that Discord puts their secrets in one of those insecure places, or was it just a guess? I believe if you always keep session cookies in secure, HTTP-only cookies, then you are more resilient to this attack. I interviewed frontend devs last year and was shocked how few knew about this stuff.

if you set the cookier header right (definitely not always the case), this is true, but the javascript can still send requests that will have that cookie included, effectively still letting the hacker use the session as the logged in user

with http-only they can't _steal_ the cookie, but they can still _use_ the cookie. It reduces the impact but doesn't fully solve it.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#375

Post by greggh »

tptacek wrote: post #42
padjo wrote: post #4

Seems like such a tiny amount of money for a bug that can be used to completely own your customers accounts. Also not much excuse for xss these days.

This comes up on every story about bug bounties. There is in general no market at all for XSS vulnerabilities. That might be different for Twitter, Facebook, Instagram, and TikTok, because of the possibility of monetizing a single strike across a whole huge social network, and there's maybe a bank-shot argument for Discord, but you really have to do a lot of work to generate the monetization story for any of those. T…

Right, but Eva found an RCE and only got $5,000.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#376

Post by [deleted] »

superasn wrote: post #128

This is a pretty scary exploit, considering how easily it could be abused. Imagine just one link in a tweet, support ticket, or email: https://discord.com/_mintlify/static/evil/exploit.svg . If you click it, JavaScript runs on the discord.com origin. Here's what could happen: - Your Discord session cookies and token could be stolen, leading to a complete account takeover. - read/write your developer applications & we…

[deleted]

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#378

Post by johnisgood »

compootr wrote: post #345
panzi wrote: post #268

Earlier quoted context omitted.

> - Your Discord session cookies and token could be stolen, leading to a complete account takeover. Discord uses HttpOnly cookies (except for the cookie consent banner).

tokens are stored in localStorage, which is accessible by JS

Well, it used to be much more accessible before, now you have to do some hack to retrieve it, and by hack, I mean some "window.webpackChunkdiscord_app.push" kinda hack, no longer your usual retrieval. Basically you have to get the token from webpack. The localStorage one does not seem to work anymore. That is what I used, but now it does not work (or rather, not always). The webpack one seems to be reliably good.

So your code goes like:

  // Try localStorage first
  const token = getLocalStorageItem('token')
  if (token) return token

  // Try webpack if localStorage fails
  const webpackToken = await getTokenFromWebpack()
  if (webpackToken) return webpackToken
and localStorage does fail often now. I knew the reason for that (something about them removing it at some point when you load the website?) so you need the webpack way, which is consistently reliable.

I believe if you search for the snippet above, you can find the code for the webpack way.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#379

Post by [deleted] »

imdsm wrote: post #336
snvzz wrote: post #133

Earlier quoted context omitted.

>the $4,000 bounty feels like a slap in the face. And serves a reminder crime does pay. In the black market, it would have been worth a bit more.

I was once only given $1,000 for an exploit where I could put in npm usernames and get their email addresses. Big corps don't always pay what they should.

[deleted]

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#380

Post by myaccountonhn »

hinkley wrote: post #54

It’s clear to me now that I need to set up my home machine the way I set up BYOD when I was contracting last. I need a separate account for all of my development. I have a friend who at one point had five monitors and 2 computers (actually it might be 3) on his desk and maybe he’s the one doing it right. He keeps his personal stuff and his programming/work stuff completely separate.

I set up a separate user that I ssh into for development. Not perfect but its something.
Post reply on HN