Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

241–250 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#241

Post by rvnx »

tptacek wrote: post #236
rvnx wrote: post #233

Earlier quoted context omitted.

Do you want to execute actions as logged-in user on high-value website XXX ? If yes -> very useful

Nobody is disputing that a wide variety of vulnerabilities are "useful", only that there's no market for most of them. I'd still urgently fix an XSS.

There is a market outside Zerodium, it's Telegram. Finding a buyer takes time and trust, but it has definitively higher value than 4k USD because of its real-world impact, no matter if it is technically lower on the CVSS scores.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#242

Post by tptacek »

rvnx wrote: post #241
tptacek wrote: post #236

Earlier quoted context omitted.

Nobody is disputing that a wide variety of vulnerabilities are "useful", only that there's no market for most of them. I'd still urgently fix an XSS.

There is a market outside Zerodium, it's Telegram. Finding a buyer takes time and trust, but it has definitively higher value than 4k USD because of its real-world impact, no matter if it is technically lower on the CVSS scores.

Really? Tell me a story about someone selling an XSS vulnerability on Telegram.

("The CVSS chart"?)

Moments later

Why do people keep bringing up "Zerodium" as if it's a thing?

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#244

Post by ajross »

RulerOf wrote: post #238
acheron wrote: post #181

Earlier quoted context omitted.

The Flash revisionism I see around here occasionally is bizarre. No, Flash was terrible and killing it was good.

It was terrible from a security POV, but the tooling was superb. I remember my teenage friends creating things with flash in a way that doesn't happen on the modern web.

Sure, but that's because the media and forums change, not so much a point about tool capability. The equivalent of teenaged geeks hacking on flash games today is influencer wannabes editting trends in CapCut. If anything content production is far more accessible now than in the 90's.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#245

Post by rainonmoon »

quasarj wrote: post #72

One of these days I'm gonna have to learn why cross-site scripting even matters, especially with modern browsers restricting a script's access to anything local

It's a good question and one mature orgs ask themselves all the time. As you can see from most of the replies here, XSS captures the fancy of the bug bounty crowd because there are tonnes of hypothetical impacts so everyone is free to let their imagination run wild when arguing with triagers. It's also the exploit nonpareil for nerdsnipers because sanitisation is always changing and people get to spend their days coming up with increasingly ridiculous payloads to bypass them. In reality, find me one active threat actor who has compromised a business lately with an XSS. It's not an irrelevant risk, but the attention it gets is wildly disproportionate to its real-world impact.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#246

Post by hunvreus »

Mintlify does look pretty, but between that and all the React exploits, I'll stick with good ol' static sites.

Kinda why I built ReallySimpleDocs [1]. Add Pages CMS [2] to it and you're set.

[1]: https://reallysimpledocs.com/

[2]: https://pagescms.org

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#247

Post by rvnx »

bpt3 wrote: post #239
rvnx wrote: post #220

Earlier quoted context omitted.

Use the PDF to JPG online services, convenient and you still get your result without having to deal with any sandbox

Except of course that you're sharing the contents of that PDF with a random online service.

True, I just considered that once you handle a PDF with so much care like if it was poisoned, it's perhaps better to send this poison to someone else to handle.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#248

Post by finghin »

james_marks wrote: post #158
finghin wrote: post #37

Earlier quoted context omitted.

Yeah, my read is that the teenage hacker confronted with this ridiculous payslip sees two ways forward: accept the pay cut for the CV benefit of working with bug bounties, or get a bit better at hiding your ass and make them really pay.

If I were 16, I’d be thinking I just made an obscene amount of money ($4,000!) messing with computers for fun, and got to meet people at a famous company. That’s a free car. Free computer. Uber eats for months. And my status with my peers as a hacker would be cemented. I get that bounty amounts are low vs SE salary, but that’s not at all how my 16yo self would see it.

When I was sixteen I was already familiar with the concept of leverage. I’m not sure if I’d have had the cajones to use it though.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#249

Post by hunvreus »

multisport wrote: post #55

decided to make a new account to post: Mintlify security is the worse I have even encountered in a modern SaaS company. They will leak your data, code, assets, etc. They will know they did this. You will tell them, they will acknowledge that they knew it happened, and didn't tell you. Your docs site will go down, and you will need to page their engineers to tell them its down. This will be a surprise to them.

Absolute self-promotion: https://github.com/hunvreus/reallysimpledocs

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#250

Post by lrvick »

lowkey_ wrote: post #117
lrvick wrote: post #108

Earlier quoted context omitted.

We normally find things like this in our usual 60 hour audit blocks. Rates change over time with demand, but today an audit of that length would be $27k. Even that is quite cheap compared to letting a blackhat find this.

If I can ask on business model, as I have a friend with a similar predicament — what percent of the time do you find vulnerabilities in those audits? Do companies push back if you don't find vulnerabilities?

We have never issued a clean report in our ~5 years of operation.

Some firms have a reputation for issuing clean reports that look good to bosses and customers, but we prefer working with clients that want an honest assessment of attack surface and how motivated blackhats will end their business.

We also stick around on retainer for firms that want security engineering consulting after audits to close the gaps we find and re-architect as needed. Unused retainer hours go into producing a lot of open source software to accelerate fixing the problems we see most often. This really incentivizes us to produce comprehensive reports that take into account how the software is developed and used in the real world.

Under our published threat model few companies pass level one, and we have helped a couple get close to level 2 with post audit consulting.

Our industry has a very long way to go as current industry standard practices are wildly dangerous and make life easy for blackhats.

https://distrust.co/threatmodel.html

Post reply on HN