Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution in Slack desktop apps

hackerone.com

Post reply on HN
Print view View original

41–50 of 201 posts

Re: Remote Code Execution in Slack desktop apps

#41

Post by Yajirobe »

oskarsv wrote: post #39

I wrote that exploit & report. Just some thoughts on comments here. Sure the bounty is low, but ultimately it's their money and their decision. They will deal with the 'consequences' of others skipping their program and some public shaming. I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces?…

> I find everyone talking about black markets etc. kind of ridiculous. Really?

Agreed. Fuck them

Re: Remote Code Execution in Slack desktop apps

#43

Post by user5994461 »

gorgoiler wrote: post #2

$1750 for that?! Security researchers need to organize! I have no idea what I’m talking about but my guess would be that the security economics of finding an RCE make it very valuable. The disclosure would be worth considerably more to Slack than this bounty. Something in the order of months’ worth of skilled labour, not hours. I suppose the economics also mean Slack only have to outpay the bad guys, so this is reall…

How would you even monetize that? This requires an existing employee access to be able to post a message to the company slack and hope other employees click it.

The vulnerability could do great to pown a company as long as you already have a compromised user account in the company. That's not a wormable RCE, that's not zero click (I'm not saying it's not bad).

Is there a market for high touch highly targeted attacks, maybe, if you can enter in business with the NSA or a ransomware group, those few who can monetize this sort of things. Good luck.

Re: Remote Code Execution in Slack desktop apps

#45

Post by outime »

oskarsv wrote: post #39

I wrote that exploit & report. Just some thoughts on comments here. Sure the bounty is low, but ultimately it's their money and their decision. They will deal with the 'consequences' of others skipping their program and some public shaming. I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces?…

I haven't said anything about black markets but:

>You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces? Jesus, not everything is about money

Not me, not you, but many people make it all about money. I don't think it's ridiculous to think that people can have absolutely zero ethics.

Re: Remote Code Execution in Slack desktop apps

#46

Post by dheera »

TheUndead96 wrote: post #42

It is my belief that most people would not use Slack if it did not have the business buy-in it now has. Most people are forced to use Slack.

Curious what the hate for Slack is. I use a 1-person Slack workspace for personal note-taking and memory extension, and I find it is also a super useful tool to manage ideas, photos, shared files in romantic relationships.

For either use case the ability to write bots for it, and the fact that it syncs across devices with multiple simultaneous logins is awesome.

Re: Remote Code Execution in Slack desktop apps

#47

Post by kamyarg »

oskarsv wrote: post #39

I wrote that exploit & report. Just some thoughts on comments here. Sure the bounty is low, but ultimately it's their money and their decision. They will deal with the 'consequences' of others skipping their program and some public shaming. I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces?…

I really hope they amend the bounty paid to actually compensate you for the find.

As a slack user, seeing them pay To be clear I am not advocating for this, but it makes me concerned as a user "some people" will be more likely to do it.

Re: Remote Code Execution in Slack desktop apps

#48

Post by Voliokis »

oskarsv wrote: post #39

I wrote that exploit & report. Just some thoughts on comments here. Sure the bounty is low, but ultimately it's their money and their decision. They will deal with the 'consequences' of others skipping their program and some public shaming. I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces?…

Unfortunately, we live in a world governed by money as a motivator. While you might not be in it for the money, many people are, to a certain degree (you know, to make a living and to be able to afford a decent life). If companies are unwilling to pay anything remotely close to what researchers' time is worth, then they shouldn't wonder when people prefer to sell the exploits that they find to those who do value their work appropriately.

And frankly, we shouldn't be giving companies a pass for being cheap because "reporting it responsibly" is the right thing to do. These companies are benefiting to a great degree by offloading vital security research onto unaffiliated and unknown third-parties. Your time, as well as the time of any other hacker or researcher, is valuable and needs to be compensated. I don't see why it's fair to any of us that we should have to work for free or for low pay-outs just because we might be doing the right thing. Same goes for any other career that is badly paid just because "they're helping people".

Re: Remote Code Execution in Slack desktop apps

#49

Post by oskarsv »

outime wrote: post #45
oskarsv wrote: post #39

I wrote that exploit & report. Just some thoughts on comments here. Sure the bounty is low, but ultimately it's their money and their decision. They will deal with the 'consequences' of others skipping their program and some public shaming. I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces?…

I haven't said anything about black markets but: >You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces? Jesus, not everything is about money Not me, not you, but many people make it all about money. I don't think it's ridiculous to think that people can have absolutely zero ethics.

Sure, absolutely they exist. But in my opinion they are the absolute minority. I've been in security for long enough to know that most people are good, otherwise we'd have major problems every day.

99% of people saying something about black markets or govt agencies have never really faced this decision or thought about it for more than 5 minutes. So it was a question - have you REALLY thought about it?

Re: Remote Code Execution in Slack desktop apps

#50

Post by oskarsv »

Voliokis wrote: post #48
oskarsv wrote: post #39

I wrote that exploit & report. Just some thoughts on comments here. Sure the bounty is low, but ultimately it's their money and their decision. They will deal with the 'consequences' of others skipping their program and some public shaming. I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces?…

Unfortunately, we live in a world governed by money as a motivator. While you might not be in it for the money, many people are, to a certain degree (you know, to make a living and to be able to afford a decent life). If companies are unwilling to pay anything remotely close to what researchers' time is worth, then they shouldn't wonder when people prefer to sell the exploits that they find to those who do value thei…

I agree with you. It's super low, but I and others will just ignore it in the future and ultimately they lose.

However, bug bounties are not a job. Nobody is forced or obligated to do anything. I'm giving them 'a pass' in the future :) It's great people are discussing this and surely it will improve things for future researchers.

I consider bug bounties like competitions. The 'prize money' is defined beforehand. You don't have to compete if you don't want it. You can also compete for the 'notoriety'. Knowing the stakes, do you complain after getting 'first place'?

Everything you own or do is only worth as much as someone is willing to pay for it, everything else is just speculation.

Post reply on HN