Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution in Slack desktop apps

hackerone.com

Post reply on HN
Print view View original

151–160 of 201 posts

Re: Remote Code Execution in Slack desktop apps

#151

Post by vmception »

oskarsv wrote: post #39

I wrote that exploit & report. Just some thoughts on comments here. Sure the bounty is low, but ultimately it's their money and their decision. They will deal with the 'consequences' of others skipping their program and some public shaming. I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces?…

> Sure the bounty is low, but ultimately it's their money and their decision.

Uh lol.

Bug bounties gravitate to their market value by showing companies how valuable they actually are and forcing them to learn.

Re: Remote Code Execution in Slack desktop apps

#152

Post by bawolff »

sjy wrote: post #4

They didn’t disclose for months, and when they did, they failed to credit the researcher who found the bug, and started their blog post by saying “This is a fancy way of saying we’ve dialed up the security of the app. It wasn’t unsafe before, but it’s double safe now.” That sucks.

Everyone's talking about low payout, but honestly the timeline seems much more annoying to me and harder to justify (was the fix for this really that hard?)

Re: Remote Code Execution in Slack desktop apps

#153

Post by todd3834 »

jcelerier wrote: post #136
todd3834 wrote: post #103

Earlier quoted context omitted.

Do you have any data the counters what I’m saying? I know people in other countries don’t make the same salaries but they are “mostly” doing pretty well for their region

> I know people in other countries don’t make the same salaries but they are “mostly” doing pretty well for their region here's some job postings for software engineer in Bordeaux, France: https://www.indeed.fr/Bordeaux-(33)-Emplois-Ingenieur-Inform... It's around three times less.

How does it compare to the local economy?

Re: Remote Code Execution in Slack desktop apps

#154

Post by bawolff »

kevsim wrote: post #5

Oh man, the use of and here is awesome. Not enough of a security guy to know if this is a typical approach, but it's devious. I guess the moral of the story is try to not having place where arbitrary HTML is injected?

Yes, blacklisting html tags instead of whitelisting (or parsing into some abstract form and reserializing) is a world of pain and very hard to get right.

Additionally, csp/iframe have a sandbox flag that can prevent navigating the _top target, which may have prevented this exploit assuming it could have been used (dont know what the slack code looks like, maybe there was some reason it wasn't applicable)

Re: Remote Code Execution in Slack desktop apps

#155

Post by todd3834 »

ShawnCleverdon wrote: post #117
todd3834 wrote: post #103

Earlier quoted context omitted.

Do you have any data the counters what I’m saying? I know people in other countries don’t make the same salaries but they are “mostly” doing pretty well for their region

>Do you have any data the counters what I’m saying? Prove me wrong is bad argumentation. >I know people in other countries don’t make the same salaries but they are “mostly” doing pretty well for their region. The burden of proof is on the person making the claim. Do you have any data to backup your claim?

I gave some proof and I’m speaking from experience. I grant that my perspective my be biased so if there is any data to the contrary then I would love to be enlightened. My goal isn’t to point out if someone is wrong for the sake of it, I hope to teach, learn or both. This was such a shocking revelation to me that I was hoping for some data.

Re: Remote Code Execution in Slack desktop apps

#156

Post by todd3834 »

trisiak wrote: post #102
todd3834 wrote: post #88

Earlier quoted context omitted.

https://levels.fyi disagrees. I can confirm the offers on there are real

That's very simplistic. Not everybody wants to work for US corporations or live in the US.

Does that mean they automatically work for almost nothing? This is so different from what I’ve observed. I would love to see where people are getting this opinion from.

Re: Remote Code Execution in Slack desktop apps

#158

Post by jsploit »

tptacek wrote: post #144
jsploit wrote: post #137

Earlier quoted context omitted.

Do you disagree with the severity? I assess it to have a 6.5 (medium) CVSS score. https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L...

CVSS is a ouija board and you can make it say whatever you want, which is why very few practitioners take it seriously.

Sure, some of it is open to interpretation, but I disagree with it not being taken seriously. This is the basis for CVEs, most bounty tables, and most audit reports (that I've seen).

Re: Remote Code Execution in Slack desktop apps

#159

Post by tptacek »

jsploit wrote: post #158
tptacek wrote: post #144

Earlier quoted context omitted.

CVSS is a ouija board and you can make it say whatever you want, which is why very few practitioners take it seriously.

Sure, some of it is open to interpretation, but I disagree with it not being taken seriously. This is the basis for CVEs, most bounty tables, and most audit reports (that I've seen).

I'm a practitioner, I've managed bug bounties for several companies, and spent 15 of the last 20 years doing assessment work almost exclusively, and nobody takes CVSS seriously. It doesn't say anything to point out that some people structure "bounty tables" based on CVSS, because, as I said, it's a ouija board; the actual rules for what bugs are worth are still ad hoc, they're just used to determine the CVSS instead of the price directly. And that's not a super common practice!

CVSS scores are put into audit reports --- at the ouiji levels clients want --- to shut up the suits in compliance.

Re: Remote Code Execution in Slack desktop apps

#160

Post by jsploit »

justsomeuser wrote: post #141
jsploit wrote: post #137

Earlier quoted context omitted.

Do you disagree with the severity? I assess it to have a 6.5 (medium) CVSS score. https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L...

I realise it’s a medium on that scale and I cannot argue otherwise. But I think how private that data is to the end user should also be taken into account. It’s a medium for technical risk (relative to server remote exec), but it should be seen as a high priority for the company and rewarded as such. If an end user were to ask that company “why did you leak all my private data” their response would be “your data is w…

The authenticated one-click social engineering aspect of this significantly lowers exploit probability and overall risk.
Post reply on HN