Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution in Slack desktop apps

hackerone.com

Post reply on HN
Print view View original

11–20 of 201 posts

Re: Remote Code Execution in Slack desktop apps

#11

Post by jcims »

gorgoiler wrote: post #2

$1750 for that?! Security researchers need to organize! I have no idea what I’m talking about but my guess would be that the security economics of finding an RCE make it very valuable. The disclosure would be worth considerably more to Slack than this bounty. Something in the order of months’ worth of skilled labour, not hours. I suppose the economics also mean Slack only have to outpay the bad guys, so this is reall…

>$1750 for that?! Security researchers need to organize!

https://hackerone.com/slack?type=team

It says right on the tin what the payout is going to be. If you don't like the terms of the program, don't participate. It's not really that difficult a concept.

Re: Remote Code Execution in Slack desktop apps

#12

Post by pansa2 »

rvz wrote: post #6

Great report on a critical RCE vulnerability in Slack. However, I will bite. $1,750 for a detailed report on a critical RCE is like rewarding sniffer-dogs with breadcrumbs. One could sell this exploit at least for 5 figures on the black market. In all cases, since Electron brings XSS to the desktop, it is a hackers paradise.

> since Electron brings XSS to the desktop, it is a hackers paradise.

Just curious - what makes XSS on the desktop different from other kinds of RCE vulnerability?

Re: Remote Code Execution in Slack desktop apps

#13

Post by slimsag »

pansa2 wrote: post #12
rvz wrote: post #6

Great report on a critical RCE vulnerability in Slack. However, I will bite. $1,750 for a detailed report on a critical RCE is like rewarding sniffer-dogs with breadcrumbs. One could sell this exploit at least for 5 figures on the black market. In all cases, since Electron brings XSS to the desktop, it is a hackers paradise.

> since Electron brings XSS to the desktop, it is a hackers paradise. Just curious - what makes XSS on the desktop different from other kinds of RCE vulnerability?

Nothing, but if Slack was a web application and not an Electron application it would mean XSS would not immediately lead to RCE, you would need XSS and a vulnerability in the browser to get an RCE. Electron is basically that for you already: a vulnerable browser.

Re: Remote Code Execution in Slack desktop apps

#14

Post by slimsag »

jcims wrote: post #11
gorgoiler wrote: post #2

$1750 for that?! Security researchers need to organize! I have no idea what I’m talking about but my guess would be that the security economics of finding an RCE make it very valuable. The disclosure would be worth considerably more to Slack than this bounty. Something in the order of months’ worth of skilled labour, not hours. I suppose the economics also mean Slack only have to outpay the bad guys, so this is reall…

>$1750 for that?! Security researchers need to organize! https://hackerone.com/slack?type=team It says right on the tin what the payout is going to be. If you don't like the terms of the program, don't participate. It's not really that difficult a concept.

Had the researchers (unethically) published it as a zero-day vulnerability in e.g. a blog post stating "the slack payout wasn't enough for us to care" - what would've been their legal risks?

I assume that would be _one_ way to get companies to care more about rewarding people who spend substantial amounts of time researching their security

Re: Remote Code Execution in Slack desktop apps

#15

Post by algesten »

sjy wrote: post #4

They didn’t disclose for months, and when they did, they failed to credit the researcher who found the bug, and started their blog post by saying “This is a fancy way of saying we’ve dialed up the security of the app. It wasn’t unsafe before, but it’s double safe now.” That sucks.

They can't go back in time and change how they did it, and they did explain and apologised for not handling it correctly.

Stuff like that happen. We should only judge them if they screw up like that again.

Re: Remote Code Execution in Slack desktop apps

#16

Post by 0xy »

So Slack offers the guy a paltry $1,750, then attempts to take credit for his work while also screwing him out of his own disclosure.

This kind of response to security researchers just invites the next researcher to sell the exploit instead, or to actively exploit it.

Why does Slack seem like a company that is floundering? It took them over two years to release a simple feature like shared channels. It seems like the app is frozen in time and the company is doing nothing except keeping the lights on and waiting for Teams to obliterate them.

Slack turned from a hungry tiger startup into an exhausted lumbering enterprise giant whose primary weapon is litigation and mudslinging (Slack initially encouraged the Teams competition, then filed suit against Microsoft in perhaps the biggest case of corporate sour grapes in some time).

Pay your security researchers properly, Slack.

Re: Remote Code Execution in Slack desktop apps

#17

Post by shermanmccoy »

0xy wrote: post #16

So Slack offers the guy a paltry $1,750, then attempts to take credit for his work while also screwing him out of his own disclosure. This kind of response to security researchers just invites the next researcher to sell the exploit instead, or to actively exploit it. Why does Slack seem like a company that is floundering? It took them over two years to release a simple feature like shared channels. It seems like the…

They would've spent multiples of that internally, just fumbling about trying to reproduce the vulnerability.

Re: Remote Code Execution in Slack desktop apps

#18

Post by wereHamster »

slimsag wrote: post #13
pansa2 wrote: post #12

Earlier quoted context omitted.

> since Electron brings XSS to the desktop, it is a hackers paradise. Just curious - what makes XSS on the desktop different from other kinds of RCE vulnerability?

Nothing, but if Slack was a web application and not an Electron application it would mean XSS would not immediately lead to RCE, you would need XSS and a vulnerability in the browser to get an RCE. Electron is basically that for you already: a vulnerable browser.

I refuse to use the Slack desktop app, and use Slack only through a web browser. I trust Chrome (Google), Firefox (Mozilla), Safari (Apple) far more than the Slack engineers.

Re: Remote Code Execution in Slack desktop apps

#20

Post by 0xy »

shermanmccoy wrote: post #17
0xy wrote: post #16

So Slack offers the guy a paltry $1,750, then attempts to take credit for his work while also screwing him out of his own disclosure. This kind of response to security researchers just invites the next researcher to sell the exploit instead, or to actively exploit it. Why does Slack seem like a company that is floundering? It took them over two years to release a simple feature like shared channels. It seems like the…

They would've spent multiples of that internally, just fumbling about trying to reproduce the vulnerability.

Considering their new desktop app didn't have even the most basic error handling for connection failures (during downtime people had bricked apps that displayed a white screen with a HTTP error), I have absolutely zero faith in Slack's engineering capabilities.

That's not an indictment of the engineers, but it's an indictment of the executives and managers responsible for the lazy stagnation they're currently in. The quality engineering is gone.

Headcount is way up, engineering budgets are way up, but feature velocity is non-existent. Meanwhile Teams is moving at lightspeed in comparison. While Teams might not be there yet, at least they're trying. Slack is doing nothing.

Post reply on HN