Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

161–170 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#161

Post by cdmyrm »

nyolfen wrote: post #110
davej wrote: post #3

Dave here, founder of ToDesktop. I've shared a write-up: https://www.todesktop.com/blog/posts/security-incident-at-to... This vulnerability was genuinely embarrassing, and I'm sorry we let it happen. After thorough internal and third-party audits, we've fundamentally restructured our security practices to ensure this scenario can't recur. Full details are covered in the linked write-up. Special thanks to Eva for resp…

no offense man but this is totally inexcusable and there is zero chance i am ever touching anything made by y'all, ever

Good call. I'd seriously considering firing the developers responsible, too.

Re: How to gain code execution on hundreds of millions of people and popular apps

#162

Post by cdmyrm »

sky2224 wrote: post #41

This is the second big attack found by this individual in what... 6 months? The previous exploit (which was in Arc browser), also leveraged a poorly configured firebase db: https://kibty.town/blog/arc/ So this is to say, at what point should we start pointing the finger at Google for allowing developers to shoot themselves in the foot so easily? Granted, I don't have much experience with firebase, but to me this just…

I'm sorry, but when will we hold the writers of crappy code responsible for their own bad decisions? Let's start there.

Re: How to gain code execution on hundreds of millions of people and popular apps

#163

Post by cdmyrm »

bastawhiz wrote: post #90
999900000999 wrote: post #56

Earlier quoted context omitted.

Firebase let's anyone get started in 30 seconds. Details like proper usage, security, etc. Those are often overlooked. Google isn't to blame if you ship a paid product without running a security audit. I use firebase essentially for hobbyist projects for me and my friends. If I had to guess these issues come about because developers are rushing to market. Not Google's fault ... What works for a prototype isn't produc…

> Google isn't to blame if you ship a paid product without running a security audit. Arguably, if you provide a service that makes it trivial to create security issues (that is to say, you have to go out of your way to use it correctly) then it's your fault. If making it secure means making it somewhat less convenient, it's 100% your fault for not making it less convenient.

Should we outlaw C because it lets you dereference null pointers, too?

Re: How to gain code execution on hundreds of millions of people and popular apps

#164

Post by cdmyrm »

prophesi wrote: post #126
999900000999 wrote: post #96

Earlier quoted context omitted.

What if I need to hack together a POC for 3 people to look at. It's my responsibility to make sure when we scale from 3 users to 30k users we take security seriously. As my old auto shop teacher used to say, if you try to idiot proof something they'll build a better idiot. Even if Google warns you in big bold print "YOU ARE DOING SOMETHING INSECURE", someone out there is going to click deploy anyway. You're arguing G…

I think that's throwing the baby out with the bathwater; sane defaults are still an important thing to think about when developing a product. And for something as important as a database, which usually requires authentication or storing personal information, let your tutorials focus on these pain points instead of the promise of a database-driven app with only clientside code. It's awesome, but I think it deserves th…

Any purported expert who uses software without considering its security is simply negligent. I'm not sure why people are trying to spin this to avoid placing the blame on the negligent programmer(s).

Re: How to gain code execution on hundreds of millions of people and popular apps

#165

Post by cdmyrm »

itsnotvalid wrote: post #99
nightpool wrote: post #53

Earlier quoted context omitted.

I don't think Firebase is really at fault here—the major issue they highlighted is that the deployment pipeline uploaded the compiled artifact to a shared bucket from a container that the user controlled. This doesn't have anything to do with firebase—it would have been just as impactful if the container building the code uploaded it to S3 from the buildbot.

Agreed. I recently stumbled upon the fact that even Hacker News is using Firebase for exposing an API for articles. Caution should be taken when writing server-side software in general.

[flagged]

Re: How to gain code execution on hundreds of millions of people and popular apps

#166

Post by cdmyrm »

TheDong wrote: post #32
mcoliver wrote: post #29

"i wanted to get on the machine where the application gets built and the easiest way to do this would be a postinstall script in package.json, so i did that with a simple reverse shell payload" Just want to make sure I understand this. They made a hello world app and submitted it to todesktop with a post install script that opened a reverse shell on the todesktop build machine? Maybe I missed it but that shouldn't be…

In what world do you have a machine which downloads source code to build it, but doesn't have outbound internet access so it can't download source code or build dependencies? Like, effectively the "build machine" here is a locked down docker container that runs "git clone && npm build", right? How do you do either of those activities without outbound network access? And outbound network access is enough on its own to…

It's called air-gapping, and lots of adults do it.

Re: How to gain code execution on hundreds of millions of people and popular apps

#167

Post by SideQuark »

LtWorf wrote: post #141
valenterry wrote: post #137

Earlier quoted context omitted.

Maybe, but just from a security point of view it's totally fine.

Getting tracked is less secure than not getting tracked.

Getting hacked is less secure than getting tracked.

Re: How to gain code execution on hundreds of millions of people and popular apps

#169

Post by cdmyrm »

TheDong wrote: post #74
areyourllySorry wrote: post #36

Earlier quoted context omitted.

you can always limit said network access to npm.

You can't since a large number of npm post-install scripts also make random arbitrary network calls. This includes things like downloading and compiling pre-compiled binaries for the native architecture hosted on random servers. npm is really cool.

[flagged]

Re: How to gain code execution on hundreds of millions of people and popular apps

#170

Post by jbverschoor »

felixrieseberg wrote: post #31

As an Electron maintainer, I'll re-iterate a warning I've told many people before: Your auto-updater and the underlying code-signing and notarization mechanisms are sacred . The recovery mechanisms for the entire system are extremely painful and often require embarrassing emails to customers. A compromised code-sign certificate is close to the top of my personal nightmares. Dave and toDesktop have build a product tha…

You know, there's this nice little thing called AppStore on the mac, and it can auto update
Post reply on HN