21 ms·

Remote Code Execution in Slack desktop apps

510 points by tonny747 6y ago

gorgoiler 6y ago
$1750 for that?! Security researchers need to organize! I have no idea what I’m talking about but my guess would be that the security economics of finding an RCE make it very valuable. The disclosure would be worth considerably more to Slack than this bounty. Something in the order of months’ worth of skilled labour, not hours. I suppose the economics also mean Slack only have to outpay the bad guys, so this is really showing us poorly compensated black hat labor is?
- jcims 6y ago
  >$1750 for that?! Security researchers need to organize! https://hackerone.com/slack?type=team https://hackerone.com/slack?type=team It says right on the tin what the payout is going to be. If you don't like the terms of the program, don't participate. It's not really that difficult a concept.
  - slimsag 6y ago
    Had the researchers (unethically) published it as a zero-day vulnerability in e.g. a blog post stating "the slack payout wasn't enough for us to care" - what would've been their legal risks? I assume that would be _one_ way to get companies to care more about rewarding people who spend substantial amounts of time researching their security
    - WrtCdEvrydy 6y ago
      A friend of mine swears that you can be sued for 'business damages' over improper disclosure. Sadly, the US is a non-permissive environment so I tend to believe it.
      - tptacek 6y ago
        I think that friend of yours is almost certainly wrong, and for decades now there have been notable researchers who disclose publicly and immediately.
      - IncRnd 6y ago
        In many cases that is correct, but in practice this will never happen.
    - jcims 6y ago
      Finding and disclosing vulnerabilities predates bug bounties by a long stretch. Bug bounties are simply an incentive for people to follow a scope and disclosure policy through a legal safe harbor and small financial incentive, but they aren't always effective at that. Folks that operate outside of the bounty program don't have that safe harbor and are likely exposed to the full force of whatever domestic 'hacking' laws exist on the books. In the US this has resulted in jail time and fines. If someone doesn't like the terms of a particular bug bounty program, I would ask why they are doing research against that company to begin with. That's like someone really wanting kids dating a person that doesn't want kids and hoping they will change their mind after they see how awesome it will be. Almost without exception, if you read the comments from the individuals reporting the bugs, they will actually defend the status quo (as is the case here if you dig around). It's mostly just loud people in the vicinity of this trying to drive up the market. Of course in my example I could try to incentivize said partner to have children by all sorts of unethical means, and there are certainly ways for researchers to try to incentivize corporations to increase bounty scope or payout by unethical means. This is generally considered 'extortion'. Lastly I think it's also important to point out that legality has nothing to do with ethics, and I certainly believe there are cases where disclosure is warranted outside of any established paradigm of 'responsible disclosure' or bounty program.
  - gorgoiler 6y ago
    I mean I certainly aren’t smart enough to complete a bounty half as big a deal as this, and I could certainly use a month’s rent in cash. My point was about the wider security economy. It feels like Slack are low balling for work which they have a moral duty (er, moral in the sense that spectres haunt Europe) to pay something more like a living / minimum wage for hackers.
  - stevenjohns 6y ago
    Your link seems to indicate that this falls into the "$5000 and up" category.
    - jcims 6y ago
      Sorry, sent the wrong link - https://hackerone.com/slack/bounty_table_versions?type=team&change=2020-08-07T21%3A17%3A54.807Z https://hackerone.com/slack/bounty_table_versions?type=team&...
- sneak 6y ago
  They have; you may have heard of ransomware. :)
- user5994461 6y ago
  How would you even monetize that? This requires an existing employee access to be able to post a message to the company slack and hope other employees click it. The vulnerability could do great to pown a company as long as you already have a compromised user account in the company. That's not a wormable RCE, that's not zero click (I'm not saying it's not bad). Is there a market for high touch highly targeted attacks, maybe, if you can enter in business with the NSA or a ransomware group, those few who can monetize this sort of things. Good luck.
  - brendawalsh 6y ago
    Twitter was vulnerable because of a social engineering attack via their Slack, so definitely possible to get access to post a message.
  - belltaco 6y ago
    A lot of companies give external folks access to their Slack to communicate. Plus there are a lot of communities that use Slack among pseudo-anonymous users. For example Reddit employees including the CEO use Slack with several hundred community moderators. An RCE on their computers would be a huge deal.
EE84M3i 6y ago
One click RCE, not zero. $1,750 still seems a little low by H1 standards, but probably not by an order of magnitude. Cool to see how they used the html injection gadget. Seems like slack messed up with the blog post but made a sincere attempt to make amends. I've noticed slack is pretty good about allowing disclosure of H1 bugs. It's a really hard sell in a lot of companies, so I think they should be applauded for that.
sjy 6y ago
They didn’t disclose for months, and when they did, they failed to credit the researcher who found the bug, and started their blog post by saying “This is a fancy way of saying we’ve dialed up the security of the app. It wasn’t unsafe before, but it’s double safe now.” That sucks.
- algesten 6y ago
  They can't go back in time and change how they did it, and they did explain and apologised for not handling it correctly. Stuff like that happen. We should only judge them if they screw up like that again.
  - luckylion 6y ago
    Aka "first murder is on the house, the second one you pay for".
    - omginternets 6y ago
      I'm not sure I agree with the parent poster, surely this isn't exactly murder.
      - KMag 6y ago
        It's a hyperbolic cheeky way of pointing out that they're getting off the hook for their first gross transgression. The GP isn't in any way suggesting mishandling this security issue was equivalent to murder. They're pointing out that if the transgression were more severe, we'd easily see right through the hole in the reasoning.
        tobr 6y ago
        You can’t just substitute different transgressions and use the same reasoning. There are plenty of crimes where it’s reasonable to be more lenient to a first-time offender, but murder is not one of them.
kevsim 6y ago
Oh man, the use of <area> and <map> here is awesome. Not enough of a security guy to know if this is a typical approach, but it's devious. I guess the moral of the story is try to not having place where arbitrary HTML is injected?
- missblit 6y ago
  Yep. HTML is a huge surface, so just blocking "interesting" tags / attributes is fragile at best (Similar to misguided attempts to block SQL injection through string validation instead of cutting off the root cause). The other moral of the story is you need to be extra careful to write a secure Electron program, since XSS is a bigger problem than it would be in a desktop browser. Step 3 shows that the RCE could execute programs outside of the JS environment.
- bawolff 6y ago
  Yes, blacklisting html tags instead of whitelisting (or parsing into some abstract form and reserializing) is a world of pain and very hard to get right. Additionally, csp/iframe have a sandbox flag that can prevent navigating the _top target, which may have prevented this exploit assuming it could have been used (dont know what the slack code looks like, maybe there was some reason it wasn't applicable)
rvz 6y ago
Great report on a critical RCE vulnerability in Slack. However, I will bite. $1,750 for a detailed report on a critical RCE is like rewarding sniffer-dogs with breadcrumbs. One could sell this exploit at least for 5 figures on the black market. In all cases, since Electron brings XSS to the desktop, it is a hackers paradise.
- tptacek 6y ago
  Can you support that statement about the black market with evidence?
  - arzel 6y ago
    agreed on 5 figures. evidence? there’s even clearnet websites where you can buy vulns. most known would be: https://0day.today https://0day.today
    - viraptor 6y ago
      What you see on that website is the cost, not the earnings though. If a private exploit costs $1.2k, you can get 5 digits by selling it 9 times. That isn't a huge number of sales, but I don't know if this exploit would sell that many times. Anyway, by disclosing on H1 you're "selling" at most once.
  - milofeynman 6y ago
    https://en.m.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.m.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.m.wikipedia.org/wiki/Zerodium https://en.m.wikipedia.org/wiki/Zerodium
    - tptacek 6y ago
      Zerodium won't buy a Slack exploit. I'm not debating whether there is a black market for exploits; there is. It just doesn't buy most of the things HN commenters think it does.
  - deleted 6y ago
0xy 6y ago
So Slack offers the guy a paltry $1,750, then attempts to take credit for his work while also screwing him out of his own disclosure. This kind of response to security researchers just invites the next researcher to sell the exploit instead, or to actively exploit it. Why does Slack seem like a company that is floundering? It took them over two years to release a simple feature like shared channels. It seems like the app is frozen in time and the company is doing nothing except keeping the lights on and waiting for Teams to obliterate them. Slack turned from a hungry tiger startup into an exhausted lumbering enterprise giant whose primary weapon is litigation and mudslinging (Slack initially encouraged the Teams competition, then filed suit against Microsoft in perhaps the biggest case of corporate sour grapes in some time). Pay your security researchers properly, Slack.
- shermanmccoy 6y ago
  They would've spent multiples of that internally, just fumbling about trying to reproduce the vulnerability.
  - 0xy 6y ago
    Considering their new desktop app didn't have even the most basic error handling for connection failures (during downtime people had bricked apps that displayed a white screen with a HTTP error), I have absolutely zero faith in Slack's engineering capabilities. That's not an indictment of the engineers, but it's an indictment of the executives and managers responsible for the lazy stagnation they're currently in. The quality engineering is gone. Headcount is way up, engineering budgets are way up, but feature velocity is non-existent. Meanwhile Teams is moving at lightspeed in comparison. While Teams might not be there yet, at least they're trying. Slack is doing nothing.
    - brendawalsh 6y ago
      The sooner Slack is out of my life, the happier I will be.
- thefreeman 6y ago
nahbulursun 6y ago
Low payout aside, it's too bad they didn't properly credit the researcher when they disclosed the vulnerability. There's always another path to getting paid for exploits: https://en.m.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.m.wikipedia.org/wiki/Market_for_zero-day_exploits.
keymone 6y ago
Damn. The next vulnerability will go for sale in dark hat circles for sure. Good job slackers.
- kamyarg 6y ago
  Unless Slack does the right thing and pays this researcher properly. It is never too late until it is.
touchpadder 6y ago
that's why I stick to the web client
- SXX 6y ago
  This. It's just insane to use all these Electron-based apps giving them access to all your data.
oskarsv 6y ago
I wrote that exploit & report. Just some thoughts on comments here. Sure the bounty is low, but ultimately it's their money and their decision. They will deal with the 'consequences' of others skipping their program and some public shaming. I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces? Jesus, not everything is about money - it was a fun challenge to chain it all together and I learned a lot from it. The most outrageous part for me was the blog post I discovered by accident - it included no references or mentions (check archive.org). Both of the code snippets there are from my RCE reports. At the same time they were denying my requests for disclosure. Of course, I understand that coordination mistakes like this happen, so I accept their apology and move on! Evidence - original RCE video with huge CSS injection overlay: https://www.dropbox.com/s/11pv2ghdkw5g84b/css-rce-overlay.mov?dl=0 https://www.dropbox.com/s/11pv2ghdkw5g84b/css-rce-overlay.mo...
- Yajirobe 6y ago
  > I find everyone talking about black markets etc. kind of ridiculous. Really? Agreed. Fuck them
- outime 6y ago
  I haven't said anything about black markets but: >You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces? Jesus, not everything is about money Not me, not you, but many people make it all about money. I don't think it's ridiculous to think that people can have absolutely zero ethics.
  - oskarsv 6y ago
    Sure, absolutely they exist. But in my opinion they are the absolute minority. I've been in security for long enough to know that most people are good, otherwise we'd have major problems every day. 99% of people saying something about black markets or govt agencies have never really faced this decision or thought about it for more than 5 minutes. So it was a question - have you REALLY thought about it?
TheUndead96 6y ago
It is my belief that most people would not use Slack if it did not have the business buy-in it now has. Most people are forced to use Slack.
- dheera 6y ago
  Curious what the hate for Slack is. I use a 1-person Slack workspace for personal note-taking and memory extension, and I find it is also a super useful tool to manage ideas, photos, shared files in romantic relationships. For either use case the ability to write bots for it, and the fact that it syncs across devices with multiple simultaneous logins is awesome.
  - brendawalsh 6y ago
    Once you use it with a decent amount of people for work, things just get ‘lost’, because the frequency of messages in a channel is so high, info is missed, or employees working on different shifts need to spend a decent amount of time at the beginning of their day to review all the missed messages, some are relevant, most are not. As you mentioned, there is also an inclination to send alerts or tasks to a channel, and similarly, the alert gets buried w additional messages, or you want up creating a bunch of ‘alert’ channels that you mute, or become hijacked and people start convos in those channels. Also, the threading sucks. It is very difficult to get users to use threads.
    - dheera 6y ago
      > Also, the threading sucks. It is very difficult to get users to use threads. I think a big part of it is it's not obvious how to create threads on mobile. A facebook-like UI for that would be nice. I wonder if this type of live UI modification could be implemented as a Chrome extension and deployed across an enterprise.
  - hacker_newz 6y ago
    How do you use a 1-person Slack workspace for shared files in relationships?
ricardobeat 6y ago
> it is still possible to inject area and map tags This is the critical oversight - what would be the reason to not use a whitelist instead, or even custom tags instead of plain HTML? Most of the existing libraries for sanitizing html work like that.
GEBBL 6y ago
What an excellent write up. I hope Slack review the payment and give you a bit more.
higerordermap 6y ago
They seem to be a company of bastard suits. Their desktop client is an abomination. Worst even among electron app. IIRC once it was spanning a process per identity. Because some manager decided to hire bootcamp webshits. It is possible to do much more decent apps with even electron. And when an article about electron was posted, a person from Slack, 'javascript hacker at slack' in his bio, jumped to defend it without even putting a disclaimer. Now they are treating a security researcher badly with this low bounties. This guy has good intentions and didn't want to sell it. But even if 10% of people sell it or use on behalf of nation state actors, imagine the dammage. Pretty sure it is some shitty MBAs who don't even know about technology being there. It is not welcome to be undeplomatic on HN, I know. But let me say this out. Fucking non technical people should not be allowed to decide on technical matters. But those shitheads generally have political abilities. That's what happened when Larry Page tried to oust those suits out of Google engineering divisions.
er0k 6y ago
so... where did the article go?
lordnacho 6y ago
Under $2K seems very cheap for what what discovered. Did it take less than two days to do this exploit? Perhaps the model should be an immediate price like the one that was offered, but also the ability to ask for more, confidentially. For instance you might feel this thing is worth more like $10k, and you could show the screengrab. Then the firm can decide whether to just pay up or haggle. And of course you still have Hacker One to arbitrate that the vuln is actually what was touted. Nothing's perfect, of course there are holes in this idea as well.
29athrowaway 6y ago
Apparently Slack has changed their bounty program payment structure, and for RCE issues they're now paying $5000 and up. https://hackerone.com/slack https://hackerone.com/slack
dowakin 6y ago
Conclusion: if you have choice between Electron vs Web app, Use Web app. It's safer and battle tested for years. Electron apps will have their IE6, Flash and Java situations.
Angeo34 6y ago
An electron app with an rce? Wow this is so unexpected never thought this would happen.

510 points by tonny747 6y ago

$1750 for that?! Security researchers need to organize! I have no idea what I’m talking about but my guess would be that the security economics of finding an RCE make it very valuable. The disclosure would be worth considerably more to Slack than this bounty. Something in the order of months’ worth of skilled labour, not hours. I suppose the economics also mean Slack only have to outpay the bad guys, so this is really showing us poorly compensated black hat labor is?

jcims 6y ago
>$1750 for that?! Security researchers need to organize! https://hackerone.com/slack?type=team https://hackerone.com/slack?type=team It says right on the tin what the payout is going to be. If you don't like the terms of the program, don't participate. It's not really that difficult a concept.
- slimsag 6y ago
  Had the researchers (unethically) published it as a zero-day vulnerability in e.g. a blog post stating "the slack payout wasn't enough for us to care" - what would've been their legal risks? I assume that would be _one_ way to get companies to care more about rewarding people who spend substantial amounts of time researching their security
  - WrtCdEvrydy 6y ago
    A friend of mine swears that you can be sued for 'business damages' over improper disclosure. Sadly, the US is a non-permissive environment so I tend to believe it.
    - tptacek 6y ago
      I think that friend of yours is almost certainly wrong, and for decades now there have been notable researchers who disclose publicly and immediately.
    - IncRnd 6y ago
      In many cases that is correct, but in practice this will never happen.
  - jcims 6y ago
    Finding and disclosing vulnerabilities predates bug bounties by a long stretch. Bug bounties are simply an incentive for people to follow a scope and disclosure policy through a legal safe harbor and small financial incentive, but they aren't always effective at that. Folks that operate outside of the bounty program don't have that safe harbor and are likely exposed to the full force of whatever domestic 'hacking' laws exist on the books. In the US this has resulted in jail time and fines. If someone doesn't like the terms of a particular bug bounty program, I would ask why they are doing research against that company to begin with. That's like someone really wanting kids dating a person that doesn't want kids and hoping they will change their mind after they see how awesome it will be. Almost without exception, if you read the comments from the individuals reporting the bugs, they will actually defend the status quo (as is the case here if you dig around). It's mostly just loud people in the vicinity of this trying to drive up the market. Of course in my example I could try to incentivize said partner to have children by all sorts of unethical means, and there are certainly ways for researchers to try to incentivize corporations to increase bounty scope or payout by unethical means. This is generally considered 'extortion'. Lastly I think it's also important to point out that legality has nothing to do with ethics, and I certainly believe there are cases where disclosure is warranted outside of any established paradigm of 'responsible disclosure' or bounty program.
- gorgoiler 6y ago
  I mean I certainly aren’t smart enough to complete a bounty half as big a deal as this, and I could certainly use a month’s rent in cash. My point was about the wider security economy. It feels like Slack are low balling for work which they have a moral duty (er, moral in the sense that spectres haunt Europe) to pay something more like a living / minimum wage for hackers.
- stevenjohns 6y ago
  Your link seems to indicate that this falls into the "$5000 and up" category.
  - jcims 6y ago
    Sorry, sent the wrong link - https://hackerone.com/slack/bounty_table_versions?type=team&change=2020-08-07T21%3A17%3A54.807Z https://hackerone.com/slack/bounty_table_versions?type=team&...
sneak 6y ago
They have; you may have heard of ransomware. :)
user5994461 6y ago
How would you even monetize that? This requires an existing employee access to be able to post a message to the company slack and hope other employees click it. The vulnerability could do great to pown a company as long as you already have a compromised user account in the company. That's not a wormable RCE, that's not zero click (I'm not saying it's not bad). Is there a market for high touch highly targeted attacks, maybe, if you can enter in business with the NSA or a ransomware group, those few who can monetize this sort of things. Good luck.
- brendawalsh 6y ago
  Twitter was vulnerable because of a social engineering attack via their Slack, so definitely possible to get access to post a message.
- belltaco 6y ago
  A lot of companies give external folks access to their Slack to communicate. Plus there are a lot of communities that use Slack among pseudo-anonymous users. For example Reddit employees including the CEO use Slack with several hundred community moderators. An RCE on their computers would be a huge deal.

EE84M3i 6y ago

One click RCE, not zero. $1,750 still seems a little low by H1 standards, but probably not by an order of magnitude. Cool to see how they used the html injection gadget. Seems like slack messed up with the blog post but made a sincere attempt to make amends. I've noticed slack is pretty good about allowing disclosure of H1 bugs. It's a really hard sell in a lot of companies, so I think they should be applauded for that.

sjy 6y ago

They didn’t disclose for months, and when they did, they failed to credit the researcher who found the bug, and started their blog post by saying “This is a fancy way of saying we’ve dialed up the security of the app. It wasn’t unsafe before, but it’s double safe now.” That sucks.

algesten 6y ago
They can't go back in time and change how they did it, and they did explain and apologised for not handling it correctly. Stuff like that happen. We should only judge them if they screw up like that again.
- luckylion 6y ago
  Aka "first murder is on the house, the second one you pay for".
  - omginternets 6y ago
    I'm not sure I agree with the parent poster, surely this isn't exactly murder.
    - KMag 6y ago
      It's a hyperbolic cheeky way of pointing out that they're getting off the hook for their first gross transgression. The GP isn't in any way suggesting mishandling this security issue was equivalent to murder. They're pointing out that if the transgression were more severe, we'd easily see right through the hole in the reasoning.
      - tobr 6y ago
        You can’t just substitute different transgressions and use the same reasoning. There are plenty of crimes where it’s reasonable to be more lenient to a first-time offender, but murder is not one of them.

kevsim 6y ago

Oh man, the use of <area> and <map> here is awesome. Not enough of a security guy to know if this is a typical approach, but it's devious. I guess the moral of the story is try to not having place where arbitrary HTML is injected?

missblit 6y ago
Yep. HTML is a huge surface, so just blocking "interesting" tags / attributes is fragile at best (Similar to misguided attempts to block SQL injection through string validation instead of cutting off the root cause). The other moral of the story is you need to be extra careful to write a secure Electron program, since XSS is a bigger problem than it would be in a desktop browser. Step 3 shows that the RCE could execute programs outside of the JS environment.
bawolff 6y ago
Yes, blacklisting html tags instead of whitelisting (or parsing into some abstract form and reserializing) is a world of pain and very hard to get right. Additionally, csp/iframe have a sandbox flag that can prevent navigating the _top target, which may have prevented this exploit assuming it could have been used (dont know what the slack code looks like, maybe there was some reason it wasn't applicable)

rvz 6y ago

Great report on a critical RCE vulnerability in Slack. However, I will bite. $1,750 for a detailed report on a critical RCE is like rewarding sniffer-dogs with breadcrumbs. One could sell this exploit at least for 5 figures on the black market. In all cases, since Electron brings XSS to the desktop, it is a hackers paradise.

tptacek 6y ago
Can you support that statement about the black market with evidence?
- arzel 6y ago
  agreed on 5 figures. evidence? there’s even clearnet websites where you can buy vulns. most known would be: https://0day.today https://0day.today
  - viraptor 6y ago
    What you see on that website is the cost, not the earnings though. If a private exploit costs $1.2k, you can get 5 digits by selling it 9 times. That isn't a huge number of sales, but I don't know if this exploit would sell that many times. Anyway, by disclosing on H1 you're "selling" at most once.
- milofeynman 6y ago
  https://en.m.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.m.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.m.wikipedia.org/wiki/Zerodium https://en.m.wikipedia.org/wiki/Zerodium
  - tptacek 6y ago
    Zerodium won't buy a Slack exploit. I'm not debating whether there is a black market for exploits; there is. It just doesn't buy most of the things HN commenters think it does.
- deleted 6y ago

0xy 6y ago

So Slack offers the guy a paltry $1,750, then attempts to take credit for his work while also screwing him out of his own disclosure. This kind of response to security researchers just invites the next researcher to sell the exploit instead, or to actively exploit it. Why does Slack seem like a company that is floundering? It took them over two years to release a simple feature like shared channels. It seems like the app is frozen in time and the company is doing nothing except keeping the lights on and waiting for Teams to obliterate them. Slack turned from a hungry tiger startup into an exhausted lumbering enterprise giant whose primary weapon is litigation and mudslinging (Slack initially encouraged the Teams competition, then filed suit against Microsoft in perhaps the biggest case of corporate sour grapes in some time). Pay your security researchers properly, Slack.

shermanmccoy 6y ago
They would've spent multiples of that internally, just fumbling about trying to reproduce the vulnerability.
- 0xy 6y ago
  Considering their new desktop app didn't have even the most basic error handling for connection failures (during downtime people had bricked apps that displayed a white screen with a HTTP error), I have absolutely zero faith in Slack's engineering capabilities. That's not an indictment of the engineers, but it's an indictment of the executives and managers responsible for the lazy stagnation they're currently in. The quality engineering is gone. Headcount is way up, engineering budgets are way up, but feature velocity is non-existent. Meanwhile Teams is moving at lightspeed in comparison. While Teams might not be there yet, at least they're trying. Slack is doing nothing.
  - brendawalsh 6y ago
    The sooner Slack is out of my life, the happier I will be.
thefreeman 6y ago

nahbulursun 6y ago

Low payout aside, it's too bad they didn't properly credit the researcher when they disclosed the vulnerability. There's always another path to getting paid for exploits: https://en.m.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.m.wikipedia.org/wiki/Market_for_zero-day_exploits.

keymone 6y ago

Damn. The next vulnerability will go for sale in dark hat circles for sure. Good job slackers.

kamyarg 6y ago
Unless Slack does the right thing and pays this researcher properly. It is never too late until it is.

touchpadder 6y ago

that's why I stick to the web client

SXX 6y ago
This. It's just insane to use all these Electron-based apps giving them access to all your data.

oskarsv 6y ago

I wrote that exploit & report. Just some thoughts on comments here. Sure the bounty is low, but ultimately it's their money and their decision. They will deal with the 'consequences' of others skipping their program and some public shaming. I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces? Jesus, not everything is about money - it was a fun challenge to chain it all together and I learned a lot from it. The most outrageous part for me was the blog post I discovered by accident - it included no references or mentions (check archive.org). Both of the code snippets there are from my RCE reports. At the same time they were denying my requests for disclosure. Of course, I understand that coordination mistakes like this happen, so I accept their apology and move on! Evidence - original RCE video with huge CSS injection overlay: https://www.dropbox.com/s/11pv2ghdkw5g84b/css-rce-overlay.mov?dl=0 https://www.dropbox.com/s/11pv2ghdkw5g84b/css-rce-overlay.mo...

Yajirobe 6y ago
> I find everyone talking about black markets etc. kind of ridiculous. Really? Agreed. Fuck them
outime 6y ago
I haven't said anything about black markets but: >You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces? Jesus, not everything is about money Not me, not you, but many people make it all about money. I don't think it's ridiculous to think that people can have absolutely zero ethics.
- oskarsv 6y ago
  Sure, absolutely they exist. But in my opinion they are the absolute minority. I've been in security for long enough to know that most people are good, otherwise we'd have major problems every day. 99% of people saying something about black markets or govt agencies have never really faced this decision or thought about it for more than 5 minutes. So it was a question - have you REALLY thought about it?

TheUndead96 6y ago

It is my belief that most people would not use Slack if it did not have the business buy-in it now has. Most people are forced to use Slack.

dheera 6y ago
Curious what the hate for Slack is. I use a 1-person Slack workspace for personal note-taking and memory extension, and I find it is also a super useful tool to manage ideas, photos, shared files in romantic relationships. For either use case the ability to write bots for it, and the fact that it syncs across devices with multiple simultaneous logins is awesome.
- brendawalsh 6y ago
  Once you use it with a decent amount of people for work, things just get ‘lost’, because the frequency of messages in a channel is so high, info is missed, or employees working on different shifts need to spend a decent amount of time at the beginning of their day to review all the missed messages, some are relevant, most are not. As you mentioned, there is also an inclination to send alerts or tasks to a channel, and similarly, the alert gets buried w additional messages, or you want up creating a bunch of ‘alert’ channels that you mute, or become hijacked and people start convos in those channels. Also, the threading sucks. It is very difficult to get users to use threads.
  - dheera 6y ago
    > Also, the threading sucks. It is very difficult to get users to use threads. I think a big part of it is it's not obvious how to create threads on mobile. A facebook-like UI for that would be nice. I wonder if this type of live UI modification could be implemented as a Chrome extension and deployed across an enterprise.
- hacker_newz 6y ago
  How do you use a 1-person Slack workspace for shared files in relationships?

ricardobeat 6y ago

> it is still possible to inject area and map tags This is the critical oversight - what would be the reason to not use a whitelist instead, or even custom tags instead of plain HTML? Most of the existing libraries for sanitizing html work like that.

GEBBL 6y ago

What an excellent write up. I hope Slack review the payment and give you a bit more.

higerordermap 6y ago

They seem to be a company of bastard suits. Their desktop client is an abomination. Worst even among electron app. IIRC once it was spanning a process per identity. Because some manager decided to hire bootcamp webshits. It is possible to do much more decent apps with even electron. And when an article about electron was posted, a person from Slack, 'javascript hacker at slack' in his bio, jumped to defend it without even putting a disclaimer. Now they are treating a security researcher badly with this low bounties. This guy has good intentions and didn't want to sell it. But even if 10% of people sell it or use on behalf of nation state actors, imagine the dammage. Pretty sure it is some shitty MBAs who don't even know about technology being there. It is not welcome to be undeplomatic on HN, I know. But let me say this out. Fucking non technical people should not be allowed to decide on technical matters. But those shitheads generally have political abilities. That's what happened when Larry Page tried to oust those suits out of Google engineering divisions.

er0k 6y ago

so... where did the article go?

lordnacho 6y ago

Under $2K seems very cheap for what what discovered. Did it take less than two days to do this exploit? Perhaps the model should be an immediate price like the one that was offered, but also the ability to ask for more, confidentially. For instance you might feel this thing is worth more like $10k, and you could show the screengrab. Then the firm can decide whether to just pay up or haggle. And of course you still have Hacker One to arbitrate that the vuln is actually what was touted. Nothing's perfect, of course there are holes in this idea as well.

29athrowaway 6y ago

Apparently Slack has changed their bounty program payment structure, and for RCE issues they're now paying $5000 and up. https://hackerone.com/slack https://hackerone.com/slack

dowakin 6y ago

Conclusion: if you have choice between Electron vs Web app, Use Web app. It's safer and battle tested for years. Electron apps will have their IE6, Flash and Java situations.

Angeo34 6y ago

An electron app with an rce? Wow this is so unexpected never thought this would happen.