Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

gist.github.com

Post reply on HN
Print view View original

441–450 of 453 posts

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#441

Post by [deleted] »

tptacek wrote: post #417
jrflowers wrote: post #412

Earlier quoted context omitted.

I can’t speak to the value of the vulnerability as I lack the universal Rolodex of Every Exploit Buyer that is apparently available (nor am I interested in debating this with somebody that admitted they didn’t know anything about the vulnerability, declared it worthless anyway, and then moved the goalposts after a core assumption about it was trivially shown to be wrong. I’m fairly certain at this point these kids co…

Can I ask which exploit buyers you are aware of? None of us know all of them! It'll be easier to discuss this with a specific buyer in mind.

[deleted]

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#442

Post by ivw »

silverwind wrote: post #215
ivw wrote: post #26

Earlier quoted context omitted.

just run them through `svgo` and get the benefits of smaller filesizes as well

svgo is a minifier, not a sanitizer.

I should have clarified `svgo + removeScripts`

https://svgo.dev/docs/plugins/removeScripts/

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#443

Post by giancarlostoro »

seaal wrote: post #396
giancarlostoro wrote: post #363

Earlier quoted context omitted.

No because Discord auth tokens dont expire soon enough. The only thing that kills them is changing your password. Idk why Discord doesnt invalidate them after some time, it is seriously amateur hour over there and has been for a while.

Probably because the end user hates login in, my friends always complain about the “remember me” button being useless for some services.

No, these are tokens that you get a new one per request, if you open up dev tools, and open the user settings panel, you will see that you get a new one every single time you open the user settings panel. They never expire, at least for years they were insanely long lasting.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#444

Post by collinmanderson »

llmslave2 wrote: post #405
collinmanderson wrote: post #372

Earlier quoted context omitted.

Generally code execution within browser/client-side javascript sandbox is just "XSS". RCE usually implies server-side code execution (or breaking out of browser sandbox).

Hmm, I've always thought of "RCE" in a more general way, regarding the ability to execute arbitrary code on a computer you don't own. For example some multiplayer games have had exploits that let hosts run arbitrary code on clients that connect to them, and I've seen that called an RCE vulnerability. shrugs

If it’s running code outside of a normal browser sandbox then, yes it’s a RCE. Because it can now access to nearly everything on the user’s computer, including their browser, email, etc.

XSS is limited to accessing just that one website.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#445

Post by jijijijij »

Aachen wrote: post #436
jijijijij wrote: post #435

Earlier quoted context omitted.

In an ideal world, these bugs, especially low-hanging fruits, shouldn't be discoverable by some random kids. These billion dollar companies should have their own security researchers constantly monitoring their stack. But those costs are cut, because the law de facto doesn't hold them liable for getting hacked. It's a very good deal for companies to pay bug bounties, but they mostly cheap out on that, too. It's like…

> these bugs, especially low-hanging fruits, shouldn't be discoverable by some random kids. These billion dollar companies should have their own security researchers [...] I'm twice this kid's age and have been doing this hobby-turned-work as long as they have. I can tell you the work we do is no different. It doesn't matter if you're 16 or 64 or what your credentials are or salary is. We're all just hackers. Hacker…

Get off your high horse. In this instance it's been a kid, and it does not concern some highly arcane flaw in a crypto library or chained kernel exploit, which may have passed even a pro. I already implied this bug should have been found by in-house security, so obviously it's within the domain of professionals and teenagers alike.

> The submission doesn't say they've even contacted Xitter.

This one doesn't. This one does: https://heartbreak.ing/. Or at least, I presume they meant Twitter when they wrote "one company valued 44 billion".

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#446

Post by degamad »

finghin wrote: post #36
FloorEgg wrote: post #6

Earlier quoted context omitted.

Supply and demand I guess. Pathetic for a senior SE but pretty awesome for a 16 year old up and coming hacker.

I hope I'm not assuming too much but I'm really hope the up and coming hacker is smart enough to know that his work was worth more than $4,000. That's 1-2% of an annual SE salary for someone with similar skillset.

> That's 1-2% of an annual SE salary for someone with similar skillset.

So commensurate for approximately 2 days of work, a little high for two hours of work, and a little low for 8 days of work.

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#447

Post by franga2000 »

I really don't get the appeal to have everything om one top-level domain, especially completely separate or even external services. The scope of this would've been basically zero if they just put it on docs.discord.com.

Especially something like this, where they were reverse proxying a SaaS, seems extra stupid. It's more work to set up, adds an unnecessary dependency between services and you end up paying for all the internet traffic three times (even if not directly).

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#448

Post by alxndr »

Aachen wrote: post #359
tptacek wrote: post #41

Earlier quoted context omitted.

I don't think anybody in SFBA-style software development, both pre- and post-LLM, is really resilient against these kinds of attacks. The problem isn't vibe coding so much as it is multiparty DLL-hell dependency stacks, which is something I attribute more to Javascript culture than to any recent advance in technology.

That's "San Francisco Bay Area" for anyone else wondering

Is this synonymous with AI-assisted coding now??

Re: We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

#450

Post by Aachen »

jijijijij wrote: post #445
Aachen wrote: post #436

Earlier quoted context omitted.

> these bugs, especially low-hanging fruits, shouldn't be discoverable by some random kids. These billion dollar companies should have their own security researchers [...] I'm twice this kid's age and have been doing this hobby-turned-work as long as they have. I can tell you the work we do is no different. It doesn't matter if you're 16 or 64 or what your credentials are or salary is. We're all just hackers. Hacker…

Get off your high horse. In this instance it's been a kid, and it does not concern some highly arcane flaw in a crypto library or chained kernel exploit, which may have passed even a pro. I already implied this bug should have been found by in-house security, so obviously it's within the domain of professionals and teenagers alike. > The submission doesn't say they've even contacted Xitter. This one doesn't. This one…

> Get off your high horse

What did I say that made you reply this way?

Post reply on HN