Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution in Slack desktop apps

hackerone.com

Post reply on HN
Print view View original

111–120 of 201 posts

Re: Remote Code Execution in Slack desktop apps

#111

Post by albntomat0 »

panpanna wrote: post #89
jcims wrote: post #83

Earlier quoted context omitted.

They can be when they try to live off of bug bounties alone. There are a lot of young folks that try to make this their full time job after some success, then get into a dry spell. The panic robs them of the lateral thinking that brought them to the dance to begin with, and they get into spirals of ravenously hunting simple bugs that end up as dupes and out of scope.

> They can be when they try to live off of bug bounties alone. I think that's the problem. You shouldn't be entirely dependent on bounty money, because sooner or later you will find a bug that is worth 10x or 1000x on the black market. I have seen white hat bounty hunters go rouge in such situations and entirely blame it on the cheap ass companies that won't offer the "right" amount. Nobody owns you anything, you are…

> Nobody owns you anything, you are doing this mostly for fun. The bounty is just a bonus.

That's missing a key point of the bounty system. Slack and its users are better off that this bug was 1: discovered and 2: responsibly reported. The bounty increases the number of eyes looking, but also incentivizes folks to look into weird crashes or fight through the drudgery of triaging odd behavior.

The bug value also shows how much Slack here values their security, and makes me wary of them if I was in the place to be a customer of theirs.

Re: Remote Code Execution in Slack desktop apps

#112

Post by oskarsv »

hartator wrote: post #104
oskarsv wrote: post #39

I wrote that exploit & report. Just some thoughts on comments here. Sure the bounty is low, but ultimately it's their money and their decision. They will deal with the 'consequences' of others skipping their program and some public shaming. I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces?…

Read your report and the way you handled things both on technical and human perspective was perfect. Sorry that they made it so difficult to disclose. We are hiring if you ever need a job! https://serpapi.com/team

thank you, appreciate some positivity :)

Re: Remote Code Execution in Slack desktop apps

#113

Post by albntomat0 »

Wowfunhappy wrote: post #56
Voliokis wrote: post #48

Earlier quoted context omitted.

Unfortunately, we live in a world governed by money as a motivator. While you might not be in it for the money, many people are, to a certain degree (you know, to make a living and to be able to afford a decent life). If companies are unwilling to pay anything remotely close to what researchers' time is worth, then they shouldn't wonder when people prefer to sell the exploits that they find to those who do value thei…

So, what is the right thing to do if you find a vulnerability in Slack?

I think the key thing is that there's a wide range in the amount of effort someone will put into looking for bugs/exploits, guided by a number of factors, like how fun the bug is to work on, the monetary reward, and any prestige from being the one to find it.

If an obvious vuln appears, obviously report it. But, these reports require a lot of work. It'd also be perfectly ok if the researcher reported whatever obscure behaviour they found initially, and went to go look at other targets with better bounties, played with their dog, etc.

Re: Remote Code Execution in Slack desktop apps

#114

Post by respondo2134 »

Barrin92 wrote: post #108
namdnay wrote: post #79

Earlier quoted context omitted.

> If you haven't had food for a few days everything is indeed about money I doubt anybody capable of finding an exploit like this is in that situation

I've met plenty of self-taught hackers in developing countries who were barely employed due to general economic dysfunction. Spend a month or two in Venezuela and you'll find plenty of qualified folks who have no steady job and are scraping by, how do you think people get into crime to begin with?

>> how do you think people get into crime to begin with?

lack of opportunity, lack of skills and lack of work ethic. As in it's easy to do, no barrier to entry and always availble.

Most crimes don't actually pay very well and have poor return if you've got any sort of marketable skills. Armed robbery of a bank will get you on average $1200 and 15-20 years.

Re: Remote Code Execution in Slack desktop apps

#115

Post by 0xy »

thefreeman wrote: post #96
0xy wrote: post #16

So Slack offers the guy a paltry $1,750, then attempts to take credit for his work while also screwing him out of his own disclosure. This kind of response to security researchers just invites the next researcher to sell the exploit instead, or to actively exploit it. Why does Slack seem like a company that is floundering? It took them over two years to release a simple feature like shared channels. It seems like the…

> A simple feature like shared channels You think merging two or more organizations workspaces in a sane and secure manner after likely basing the entire app infrastructure around the idea of a single workspace is a "simple feature"? This is a textbook example of the classic HN comment "Why does this this company need X engineers to create Y product. I could do it in a weekend."

Except I never claimed it could be done in a weekend, only that it shouldn't take 1,600 employees two years to roll out a single feature while the main app has severe problems (zero error handling during downtime).

Then there's Slack's other "features", like the rich text editor nobody liked or wanted and that they initially refused to change.

Look at Teams' trajectory in the same timeframe.

Slack video calling is still bad. It's been years.

Re: Remote Code Execution in Slack desktop apps

#116

Post by albntomat0 »

kamyarg wrote: post #47
oskarsv wrote: post #39

I wrote that exploit & report. Just some thoughts on comments here. Sure the bounty is low, but ultimately it's their money and their decision. They will deal with the 'consequences' of others skipping their program and some public shaming. I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces?…

I really hope they amend the bounty paid to actually compensate you for the find. As a slack user, seeing them pay To be clear I am not advocating for this, but it makes me concerned as a user "some people" will be more likely to do it.

Another likely outcome is that folks aren't going to look at all, or only at a surface level. This leaves low hanging bugs for those with malicious intent to find easily.

Re: Remote Code Execution in Slack desktop apps

#117

Post by ShawnCleverdon »

todd3834 wrote: post #103
vermilingua wrote: post #98

Earlier quoted context omitted.

You replied to a claim about “most software” with a site that compares big tech companies, and only their US offices. The world is much bigger than your bubble.

Do you have any data the counters what I’m saying? I know people in other countries don’t make the same salaries but they are “mostly” doing pretty well for their region

>Do you have any data the counters what I’m saying?

Prove me wrong is bad argumentation.

>I know people in other countries don’t make the same salaries but they are “mostly” doing pretty well for their region.

The burden of proof is on the person making the claim. Do you have any data to backup your claim?

Re: Remote Code Execution in Slack desktop apps

#118

Post by klyrs »

oskarsv wrote: post #49
outime wrote: post #45

Earlier quoted context omitted.

I haven't said anything about black markets but: >You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces? Jesus, not everything is about money Not me, not you, but many people make it all about money. I don't think it's ridiculous to think that people can have absolutely zero ethics.

Sure, absolutely they exist. But in my opinion they are the absolute minority. I've been in security for long enough to know that most people are good, otherwise we'd have major problems every day. 99% of people saying something about black markets or govt agencies have never really faced this decision or thought about it for more than 5 minutes. So it was a question - have you REALLY thought about it?

I'd hypothesize that people are more willing to entertain the profiteering fantasy when they aren't realistically facing the consequences. Also, that people are more willing to be jerks under cloak of anonymity. As you note, perhaps only 1% of people with the drive to find these sploits are going to do something bad with them. That means the extra volume is folks who wish they had such a product to sell on the black market are just jealous wannabes. You can ignore them.

Re: Remote Code Execution in Slack desktop apps

#119

Post by hartator »

oskarsv wrote: post #112
hartator wrote: post #104

Earlier quoted context omitted.

Read your report and the way you handled things both on technical and human perspective was perfect. Sorry that they made it so difficult to disclose. We are hiring if you ever need a job! https://serpapi.com/team

thank you, appreciate some positivity :)

It’s well deserved! :) Feel to email me directly if you have any question. julien _at_ serpapi.com

Re: Remote Code Execution in Slack desktop apps

#120

Post by JoeCortopassi »

namdnay wrote: post #79
krageon wrote: post #73

Earlier quoted context omitted.

> You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces? Jesus, not everything is about money If you haven't had food for a few days everything is indeed about money. Either you reward someone properly for the work that they can do or they'll find someone else who does. I doubt most people get fuzzy warm feelings helping a big US corporation that's too greedy to actuall…

> If you haven't had food for a few days everything is indeed about money I doubt anybody capable of finding an exploit like this is in that situation

So many comments to this saying it's possible to be broke as a software developer. No one is arguing that. There are tons of people in every career path that don't make much due to a variety of reasons.

But pretending software development isn't a well paying career path, in general, is a statistically incorrect statement

Post reply on HN