Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

121–130 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#121

Post by valenterry »

sky2224 wrote: post #41

This is the second big attack found by this individual in what... 6 months? The previous exploit (which was in Arc browser), also leveraged a poorly configured firebase db: https://kibty.town/blog/arc/ So this is to say, at what point should we start pointing the finger at Google for allowing developers to shoot themselves in the foot so easily? Granted, I don't have much experience with firebase, but to me this just…

The problem is that if there is a security incident, basically nobody cares except for some of us here. Normal people just ignore it. Until that changes, nothing you do will change the situation.

Re: How to gain code execution on hundreds of millions of people and popular apps

#123

Post by beardedwizard »

davej wrote: post #3

Dave here, founder of ToDesktop. I've shared a write-up: https://www.todesktop.com/blog/posts/security-incident-at-to... This vulnerability was genuinely embarrassing, and I'm sorry we let it happen. After thorough internal and third-party audits, we've fundamentally restructured our security practices to ensure this scenario can't recur. Full details are covered in the linked write-up. Special thanks to Eva for resp…

Annual pen tests are great, but what are you doing to actually improve the engineering design process that failed to identify this gap? How can you possibly claim to be confident this won't happen again unless you myopically focus on this single bug, which itself is a symptom of a larger design problem.

These kinds of "never happen again" statements never age well, and make no sense to even put forward.

A more pragmatic response might look like: something similar can and probably will happen again, just like any other bugs. Here are the engineering standards we use ..., here is how they compare to our peers our size ..., here are our goals with it ..., here is how we know when to improve it...

Re: How to gain code execution on hundreds of millions of people and popular apps

#125

Post by beardedwizard »

abhiaagarwal wrote: post #22
spudlyo wrote: post #9

Earlier quoted context omitted.

> cannot happen again. Hubris. Does not inspire confidence. > We resolved the vulnerability within 26 hours of its initial report, and additional security audits were completed by February 2025. After reading the vulnerability report, I am impressed at how quickly you guys jumped on the fix, so kudos. Did the security audit lead to any significant remediation work? If you weren't following PoLP, I wonder what else ma…

Based on the claims on the blog, it feels reasonable to say that this "cannot" occur again.

Based on which claim? That 12 months from now they might accidentally discover a new bug just as serious?

Re: How to gain code execution on hundreds of millions of people and popular apps

#126

Post by prophesi »

999900000999 wrote: post #96
bastawhiz wrote: post #90

Earlier quoted context omitted.

> Google isn't to blame if you ship a paid product without running a security audit. Arguably, if you provide a service that makes it trivial to create security issues (that is to say, you have to go out of your way to use it correctly) then it's your fault. If making it secure means making it somewhat less convenient, it's 100% your fault for not making it less convenient.

What if I need to hack together a POC for 3 people to look at. It's my responsibility to make sure when we scale from 3 users to 30k users we take security seriously. As my old auto shop teacher used to say, if you try to idiot proof something they'll build a better idiot. Even if Google warns you in big bold print "YOU ARE DOING SOMETHING INSECURE", someone out there is going to click deploy anyway. You're arguing G…

I think that's throwing the baby out with the bathwater; sane defaults are still an important thing to think about when developing a product. And for something as important as a database, which usually requires authentication or storing personal information, let your tutorials focus on these pain points instead of the promise of a database-driven app with only clientside code. It's awesome, but I think it deserves the notoriety for letting you shoot yourself in the foot and landing on the front page of HN. Author also found a similar exploit via Firebase for the Arc Browser[0]

I have a similar qualm with GraphQL.

[0] https://kibty.town/blog/arc/

Re: How to gain code execution on hundreds of millions of people and popular apps

#127

Post by kylecodes »

"the build container now has a privileged sidecar that does all of the signing, uploading and everything else instead of the main container with user code having that logic."

Does this info about the fix seem alarming to anyone else? It's not a full description, so maybe some important details are left out? My understanding is that containers are generally not considered a secure enough boundary. Companies such as AWS use micro VMs (Firecracker) for secure multi tenant container workloads.

Re: How to gain code execution on hundreds of millions of people and popular apps

#128

Post by vitiral »

TZubiri wrote: post #75

I can't post things like "what a bunch of clowns" due to hacker news guidelines so let me go by another more productive route. These people, the ones who install dependencies (that install dependencies)+, these people who write apps with AI, who in the previous season looped between executing their code and searching the error on stackoverflow. Whether they work for a company or have their own startup, the moment tha…

https://civboot.org

Join me my brother or sister

Re: How to gain code execution on hundreds of millions of people and popular apps

#130

Post by oriettaxx »

sphars wrote: post #105
richardboegli wrote: post #25

Earlier quoted context omitted.

> they were nice enough to compensate me for my efforts and were very nice in general. They were compensated, but doesn't elaborate.

They later updated their post, at the bottom: > for those wondering, in total i got 5k for this vuln, which i dont blame todesktop for because theyre a really small company

50.000$ additional to the first 5.000$ :)

Woooowwww!

See latest line: "update: cursor (one of the affected customers) is giving me 50k USD for my efforts."

Post reply on HN