Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

381–390 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#381

Post by Rapzid »

fergie wrote: post #316
0xbadcafebee wrote: post #40

How these companies don't hire kids like Daniel for pennies on the dollar and have him attack their stacks on a loop baffles me. Pay the kid $50k/yr (part time, he still needs to go to school) to constantly probe your crappy stacks. Within a year or two you'll have the most goddamn secure company on the internet - and no public vulns to embarrass you.

I feel like the "I'm a 16 year old high school senior" thing is some kind of social engineering- his knowledge seems a bit too broad. But who knows.

Who knows indeed.

It's easier than ever to pretend you know more than you do on the internet these days..

Not saying that's the case here, but that's the world we live in now.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#382

Post by joenot443 »

0xbadcafebee wrote: post #40

How these companies don't hire kids like Daniel for pennies on the dollar and have him attack their stacks on a loop baffles me. Pay the kid $50k/yr (part time, he still needs to go to school) to constantly probe your crappy stacks. Within a year or two you'll have the most goddamn secure company on the internet - and no public vulns to embarrass you.

Apple hired George Hotz (geohot) after he wrote the old 2010s iOS jailbreaks.

It wouldn't surprise me if he's in this thread - curious what his thoughts would be.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#383

Post by rkomorn »

tptacek wrote: post #205
wiether wrote: post #114

Earlier quoted context omitted.

That's a bit simplistic. If you sign a contract with a "hacker", then you are expecting results. Otherwise how do you decide to renew the contract next year? How do you decide to raise it next year? What if, during this contract, a vulnerability that this individual didn't found is exploited? You get rid of them? So you're putting pressure on a person who is a researcher, not a producer. Which is wrong. And also ther…

Just going to say here that people routinely engage pentest firms, several times annually, for roughly that sum of money, hoping but not expecting game-over vulnerabilities (and, from bitter experience as a buyer rather than a seller of those services over the last 5 years --- "no game-over vulnerabilities" is a very common outcome!)

> from bitter experience as a buyer rather than a seller of those services over the last 5 years --- "no game-over vulnerabilities" is a very common outcome!

Why bitter? Did they miss some?

Otherwise, isn't that the goal to begin with? Shouldn't you be proud instead?

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#384

Post by 0xbadcafebee »

tptacek wrote: post #93
0xbadcafebee wrote: post #53

Earlier quoted context omitted.

I can't imagine intelligence agencies/DoD not doing this with their gargantuan black budgets, if it's relevant to a specific target. They already contract with private research centers to develop exploits, and it's not like they're gonna run short on cash

If that were the case, we'd routinely see mysterious XSS exploits on social networks. The underlying bugs are almost always difficult to target! And yet we do not. The biggest problem, again, is that the vulnerabilities disappear instantaneously when the vendors learn about them; in fact, they disappear in epsilon time once the vulnerabilities are used , which is not how e.g. a mobile browser drive-by works.

They have a class of attacks which are used for targeted intrusion into foreign entities. Typically espionage or cyberwarfare, so they're not often used (they're aware they might be a one-use attack), but some persist for a long time. Foreign entities also tend not to admit to the attacks when found, so if the vendor is a US entity, often the vendor doesn't find out. We do the same; when our intelligence agencies find out about a US compromise, they often keep mum about it.

I'm not talking about XSS specifically, I mean in general. An XSS isn't usually high-value, but if it affects the right target, it can be very valuable. Imagine an XSS or CSRF vuln in a web interface for firmware for industrial controls used by an enemy state, or a corporation in that state. It might only take 2 or 3 vectors to get to that point and then you have remote control of critical infrastructure.

Oh - and the idea that a vendor will always patch a hole when they find it? Not completely true. I have seen very suspicious things going on at high value vendors (w/their products), and asked questions, and nobody did anything. In my experience, management/devs are often quite willing to ignore potential compromise just to keep focusing on the quarterly goals.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#385

Post by sebmellen »

sdf456 wrote: post #350
notnullorvoid wrote: post #257

Earlier quoted context omitted.

To be clear only the path and query parameters part of the url can change, the domain (or sub domain) stays intact.

Even scarier to me than the vulnerability is that Fidelity (whom I personally think is a good bank and investment company) was using a third party that allowed injection that could potentially steal a whole lot of money, affect markets, ruin or terminate billions of lives, and affect the course of humanity. What the fuck.

That’s why I’m a Schwab junkie… but finance is a hotspot for this kind of stuff.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#386

Post by GoblinSlayer »

Sohcahtoa82 wrote: post #129
aidenn0 wrote: post #44

Earlier quoted context omitted.

External entities in XML[1] were a similar issue back when everyone was using XML for everything, and parsers processed external-entities by default. 1: https://owasp.org/www-community/vulnerabilities/XML_External...

XXE should have never existed. Whoever decided it should be enabled by default should be put into some sort of cybersecurity jail.

It's no different from links to googlesyndication in offline html docs.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#387

Post by udev4096 »

sdf456 wrote: post #350
notnullorvoid wrote: post #257

Earlier quoted context omitted.

To be clear only the path and query parameters part of the url can change, the domain (or sub domain) stays intact.

Even scarier to me than the vulnerability is that Fidelity (whom I personally think is a good bank and investment company) was using a third party that allowed injection that could potentially steal a whole lot of money, affect markets, ruin or terminate billions of lives, and affect the course of humanity. What the fuck.

[dead]

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#388

Post by [deleted] »

MajesticHobo2 wrote: post #192
vablings wrote: post #152

Earlier quoted context omitted.

Why would YOU see a mystery XSS exploit on a social network? The idea of the DoD scoring these little exploits in a box is usually to deploy in a highly controlled and specific manner. You as a layperson is of no interest to them unless you are some kind of intelligence asset or foreign adversary

Wouldn't platforms see the supposed XSS payloads in their logs and publish analyses of them, or at the very least, announce that they happened?

[deleted]

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#389

Post by GoblinSlayer »

collinmanderson wrote: post #370
staticassertion wrote: post #277

Earlier quoted context omitted.

No, svgs can do `onload` and `onerror` and also reference other svgs that can themselves contain those things (base64'd or behind a URI). But you can use an `img` tag (` `) and that'll basically Just Work, or use a CSP. I wouldn't rely on sanitizing, but I'd still sanitize.

> But you can use an `img` tag (` `) and that'll basically Just Work That doesn't help too much if evil.svg is hosted on the same domain (with default "Content-Type: image/svg+xml" header), because attacker can send a direct link to the file.

Reddit horribly breaks direct links to images and serves html instead.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#390

Post by GoblinSlayer »

silverwind wrote: post #217
zffr wrote: post #122

Earlier quoted context omitted.

I would have expected SVGs to be like PDFs and render the same across devices. Is the issue that some renderers don’t implement the full spec, or that some implement parts incorrectly?

SVG can for example contain text elements rendered with a font. If the font is not available it will render in a different one. The issue can be avoided by turning text elements into paths, but not all SVGs do that.

Also text zoom.
Post reply on HN