Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution in Slack desktop apps

hackerone.com

Post reply on HN
Print view View original

21–30 of 201 posts

Re: Remote Code Execution in Slack desktop apps

#21

Post by 0x0 »

pansa2 wrote: post #12
rvz wrote: post #6

Great report on a critical RCE vulnerability in Slack. However, I will bite. $1,750 for a detailed report on a critical RCE is like rewarding sniffer-dogs with breadcrumbs. One could sell this exploit at least for 5 figures on the black market. In all cases, since Electron brings XSS to the desktop, it is a hackers paradise.

> since Electron brings XSS to the desktop, it is a hackers paradise. Just curious - what makes XSS on the desktop different from other kinds of RCE vulnerability?

nodeIntegration:true

Re: Remote Code Execution in Slack desktop apps

#22

Post by laurent92 »

rvz wrote: post #6

Great report on a critical RCE vulnerability in Slack. However, I will bite. $1,750 for a detailed report on a critical RCE is like rewarding sniffer-dogs with breadcrumbs. One could sell this exploit at least for 5 figures on the black market. In all cases, since Electron brings XSS to the desktop, it is a hackers paradise.

When running a security bounty, what makes me afraid is the compounding factor of finding the same kind of issue several times in different places, thereby multiplying the cost by 20. Of course $1750 is cheap, but I’d happily donate more if there is there were no risk of paying repeat bounties, given a week between them to fix each category of security failure I learn about.

By the way, the security bounty should be mandatory to display to customers. It’s like saying “We don’t value the sum of all your data of all customers to more than $1750”.

Re: Remote Code Execution in Slack desktop apps

#23

Post by greggman3 »

pansa2 wrote: post #12
rvz wrote: post #6

Great report on a critical RCE vulnerability in Slack. However, I will bite. $1,750 for a detailed report on a critical RCE is like rewarding sniffer-dogs with breadcrumbs. One could sell this exploit at least for 5 figures on the black market. In all cases, since Electron brings XSS to the desktop, it is a hackers paradise.

> since Electron brings XSS to the desktop, it is a hackers paradise. Just curious - what makes XSS on the desktop different from other kinds of RCE vulnerability?

Part of this is Electron's environment and arguably fault.

Electron used to default to insecure. You were basically running a web browser except with full access your entire machine file system/camera/mic/network etc. If you are an inexperienced developer it wasn't obvious that live linking to any 3rd party code could be an issue. Electron kind of fixed that. They warn you now and default to more secure. How many devs are capable of keeping it secure is up for debate.

As a related issue, it used to be (maybe still is) that by default, links you click in Electron open in Electron. So you make any app that accepts user data and links and suddenly people are browsing the entire net in an un-secured browser.

And worse, they break stuff. I made an electron app and explicitly made it so all links open in the user's browser. I updated to a new version and then to my horror found whatever I had done to make sure links opened in an external browser stopped opening links in an external browser.

Native apps can have exploits but most native apps aren't designed to be an environment for running arbitrary code. They're only an app for working on data.

Note, I love Electron, I've used it for several projects and it's great. But I'm also afraid of it and wish OSes were themselves more sandboxed so I didn't have to worry about it.

Re: Remote Code Execution in Slack desktop apps

#24

Post by luckylion »

algesten wrote: post #15
sjy wrote: post #4

They didn’t disclose for months, and when they did, they failed to credit the researcher who found the bug, and started their blog post by saying “This is a fancy way of saying we’ve dialed up the security of the app. It wasn’t unsafe before, but it’s double safe now.” That sucks.

They can't go back in time and change how they did it, and they did explain and apologised for not handling it correctly. Stuff like that happen. We should only judge them if they screw up like that again.

Aka "first murder is on the house, the second one you pay for".

Re: Remote Code Execution in Slack desktop apps

#25

Post by omginternets »

luckylion wrote: post #24
algesten wrote: post #15

Earlier quoted context omitted.

They can't go back in time and change how they did it, and they did explain and apologised for not handling it correctly. Stuff like that happen. We should only judge them if they screw up like that again.

Aka "first murder is on the house, the second one you pay for".

I'm not sure I agree with the parent poster, surely this isn't exactly murder.

Re: Remote Code Execution in Slack desktop apps

#26

Post by viraptor »

arzel wrote: post #8
tptacek wrote: post #7

Earlier quoted context omitted.

Can you support that statement about the black market with evidence?

agreed on 5 figures. evidence? there’s even clearnet websites where you can buy vulns. most known would be: https://0day.today

What you see on that website is the cost, not the earnings though. If a private exploit costs $1.2k, you can get 5 digits by selling it 9 times. That isn't a huge number of sales, but I don't know if this exploit would sell that many times. Anyway, by disclosing on H1 you're "selling" at most once.

Re: Remote Code Execution in Slack desktop apps

#27

Post by tobr »

luckylion wrote: post #24
algesten wrote: post #15

Earlier quoted context omitted.

They can't go back in time and change how they did it, and they did explain and apologised for not handling it correctly. Stuff like that happen. We should only judge them if they screw up like that again.

Aka "first murder is on the house, the second one you pay for".

How does it make even a little sense to compare this to murder?

Re: Remote Code Execution in Slack desktop apps

#28

Post by sneak »

gorgoiler wrote: post #2

$1750 for that?! Security researchers need to organize! I have no idea what I’m talking about but my guess would be that the security economics of finding an RCE make it very valuable. The disclosure would be worth considerably more to Slack than this bounty. Something in the order of months’ worth of skilled labour, not hours. I suppose the economics also mean Slack only have to outpay the bad guys, so this is reall…

They have; you may have heard of ransomware. :)

Re: Remote Code Execution in Slack desktop apps

#30

Post by KMag »

omginternets wrote: post #25
luckylion wrote: post #24

Earlier quoted context omitted.

Aka "first murder is on the house, the second one you pay for".

I'm not sure I agree with the parent poster, surely this isn't exactly murder.

It's a hyperbolic cheeky way of pointing out that they're getting off the hook for their first gross transgression. The GP isn't in any way suggesting mishandling this security issue was equivalent to murder.

They're pointing out that if the transgression were more severe, we'd easily see right through the hole in the reasoning.

Post reply on HN