I wrote that exploit & report. Just some thoughts on comments here.
Sure the bounty is low, but ultimately it's their money and their decision. They will deal with the 'consequences' of others skipping their program and some public shaming.
I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces? Jesus, not everything is about money - it was a fun challenge to chain it all together and I learned a lot from it.
The most outrageous part for me was the blog post I discovered by accident - it included no references or mentions (check archive.org). Both of the code snippets there are from my RCE reports. At the same time they were denying my requests for disclosure.
Of course, I understand that coordination mistakes like this happen, so I accept their apology and move on!
> You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces? Jesus, not everything is about money
If you haven't had food for a few days everything is indeed about money. Either you reward someone properly for the work that they can do or they'll find someone else who does. I doubt most people get fuzzy warm feelings helping a big US corporation that's too greedy to actually pay independent researchers properly.
Edit: That's not to say your work wasn't cool btw. It's very admirable for you to view it the way you do.
> I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces?
I work with some security engineers who in previous jobs used to write exploits for the highest bidder. Their stuff ended up being used for exactly this. One of them even told me quite proudly, you know that exploit that was in the news, that was mine.
The lack of any ethical framework other than "I want to make as much money as possible" viscerally disgusts me. And there is far too much of this in our industry, it's rife with this sort of ingrained dollar-chasing selfishness with not a care of the consequences.
Good on you for taking a positive ethical stand against this. It's very refreshing to hear.
I really hope they amend the bounty paid to actually compensate you for the find.
As a slack user, seeing them pay < $2K for RCE report does not make me feel safe. Next person finding something similar might be looking into this and saying "$3K? no thank you, I take the risk of getting caught but being paid fairly."
To be clear I am not advocating for this, but it makes me concerned as a user "some people" will be more likely to do it.
Read your report and the way you handled things both on technical and human perspective was perfect. Sorry that they made it so difficult to disclose. We are hiring if you ever need a job! https://serpapi.com/team
I'm so sorry this happened, the CSO reached out and acknowledged the issue which was.. The minimum, but I'd be doing an internal RCA at Slack for how that post made it public without any acknowledgement.
Just sucks - marketing, legal, the engineer and peers who reviewed it, security..
your response wrt black markets strikes me as incredibly naive knowing all the crime, murder, gross negligence causing death and corruption there is and has been literally everywhere on the planet, since forever, for money
Unfortunately, we live in a world governed by money as a motivator. While you might not be in it for the money, many people are, to a certain degree (you know, to make a living and to be able to afford a decent life). If companies are unwilling to pay anything remotely close to what researchers' time is worth, then they shouldn't wonder when people prefer to sell the exploits that they find to those who do value their work appropriately.
And frankly, we shouldn't be giving companies a pass for being cheap because "reporting it responsibly" is the right thing to do. These companies are benefiting to a great degree by offloading vital security research onto unaffiliated and unknown third-parties. Your time, as well as the time of any other hacker or researcher, is valuable and needs to be compensated. I don't see why it's fair to any of us that we should have to work for free or for low pay-outs just because we might be doing the right thing. Same goes for any other career that is badly paid just because "they're helping people".
> I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces? Jesus, not everything is about money - it was a fun challenge to chain it all together and I learned a lot from it.
Slack is directly taking advantage of that being the only alternative. You can do whatever you want with the money. However, having a robust bug bounty program ensures a wide range of people are both willing and able to look for and report vulnerabilities. This needs to be a requirement for any large successful company handling a large amount of user data. Slack can definitely afford it, and this can be used against them the next time they report a breach.
They didn’t disclose for months, and when they did, they failed to credit the researcher who found the bug, and started their blog post by saying “This is a fancy way of saying we’ve dialed up the security of the app. It wasn’t unsafe before, but it’s double safe now.” That sucks.
Everyone's talking about low payout, but honestly the timeline seems much more annoying to me and harder to justify (was the fix for this really that hard?)
Great report on a critical RCE vulnerability in Slack. However, I will bite.
$1,750 for a detailed report on a critical RCE is like rewarding sniffer-dogs with breadcrumbs. One could sell this exploit at least for 5 figures on the black market.
In all cases, since Electron brings XSS to the desktop, it is a hackers paradise.
Damn, didn't know $1750 was low. I got something similar for reporting an exploit to Microsoft, where opening an attached ICS/calendar entry in Outlooks web client allowed me to execute arbitrary JavaScript on outlook.microsoft.com as the current user. Should have asked for more!
When running a security bounty, what makes me afraid is the compounding factor of finding the same kind of issue several times in different places, thereby multiplying the cost by 20. Of course $1750 is cheap, but I’d happily donate more if there is there were no risk of paying repeat bounties, given a week between them to fix each category of security failure I learn about.
By the way, the security bounty should be mandatory to display to customers. It’s like saying “We don’t value the sum of all your data of all customers to more than $1750”.
$1750 for that?! Security researchers need to organize!
I have no idea what I’m talking about but my guess would be that the security economics of finding an RCE make it very valuable. The disclosure would be worth considerably more to Slack than this bounty. Something in the order of months’ worth of skilled labour, not hours.
I suppose the economics also mean Slack only have to outpay the bad guys, so this is really showing us poorly compensated black hat labor is?
How would you even monetize that? This requires an existing employee access to be able to post a message to the company slack and hope other employees click it.
The vulnerability could do great to pown a company as long as you already have a compromised user account in the company. That's not a wormable RCE, that's not zero click (I'm not saying it's not bad).
Is there a market for high touch highly targeted attacks, maybe, if you can enter in business with the NSA or a ransomware group, those few who can monetize this sort of things. Good luck.
It says right on the tin what the payout is going to be. If you don't like the terms of the program, don't participate. It's not really that difficult a concept.
One click RCE, not zero. $1,750 still seems a little low by H1 standards, but probably not by an order of magnitude.
Cool to see how they used the html injection gadget.
Seems like slack messed up with the blog post but made a sincere attempt to make amends.
I've noticed slack is pretty good about allowing disclosure of H1 bugs. It's a really hard sell in a lot of companies, so I think they should be applauded for that.
Yep. HTML is a huge surface, so just blocking "interesting" tags / attributes is fragile at best (Similar to misguided attempts to block SQL injection through string validation instead of cutting off the root cause).
The other moral of the story is you need to be extra careful to write a secure Electron program, since XSS is a bigger problem than it would be in a desktop browser. Step 3 shows that the RCE could execute programs outside of the JS environment.
Yes, blacklisting html tags instead of whitelisting (or parsing into some abstract form and reserializing) is a world of pain and very hard to get right.
Additionally, csp/iframe have a sandbox flag that can prevent navigating the _top target, which may have prevented this exploit assuming it could have been used (dont know what the slack code looks like, maybe there was some reason it wasn't applicable)
So Slack offers the guy a paltry $1,750, then attempts to take credit for his work while also screwing him out of his own disclosure.
This kind of response to security researchers just invites the next researcher to sell the exploit instead, or to actively exploit it.
Why does Slack seem like a company that is floundering? It took them over two years to release a simple feature like shared channels. It seems like the app is frozen in time and the company is doing nothing except keeping the lights on and waiting for Teams to obliterate them.
Slack turned from a hungry tiger startup into an exhausted lumbering enterprise giant whose primary weapon is litigation and mudslinging (Slack initially encouraged the Teams competition, then filed suit against Microsoft in perhaps the biggest case of corporate sour grapes in some time).
You think merging two or more organizations workspaces in a sane and secure manner after likely basing the entire app infrastructure around the idea of a single workspace is a "simple feature"? This is a textbook example of the classic HN comment "Why does this this company need X engineers to create Y product. I could do it in a weekend."
I had a very similar experience with Slack. We were working with their support team because we didn’t realize a vulnerability was present at first. We thought maybe we had misconfigured something. Basically, we could log in to Slack Desktop with user a, but sometimes the screen would blink, then you would have full access to user b’s chats, you were messaging as them, etc. The Slack team told us to clear our browser cache. We tried that and told them the issue didn’t seem to be tied to a browser. Slack just kept telling us to clear cache, but we were growing more alarmed by the app behavior as a standard user suddenly got access to an administrator account and was able to perform all functions. Finally, we started digging into it ourselves until we could reproduce the issue. Slack didn’t get serious with us until we sent them a recording of us doing it, then their responses got strange. All of our emails back to the technicians were getting intercepted by someone higher up in the company, and we were getting a lot of non-answers. We were told a fix was put in place, but they wouldn’t know what happened until they added additional logging in two months time.
I don’t know where I’m going with this, but the correspondence with Slack just felt off to me. I was also disappointed that we were shouting from the rooftops a serious vulnerability, and we kept getting responses like “clear cache, try reinstalling the app.”
Conclusion: if you have choice between Electron vs Web app, Use Web app. It's safer and battle tested for years. Electron apps will have their IE6, Flash and Java situations.
Under $2K seems very cheap for what what discovered. Did it take less than two days to do this exploit?
Perhaps the model should be an immediate price like the one that was offered, but also the ability to ask for more, confidentially. For instance you might feel this thing is worth more like $10k, and you could show the screengrab. Then the firm can decide whether to just pay up or haggle. And of course you still have Hacker One to arbitrate that the vuln is actually what was touted.
Nothing's perfect, of course there are holes in this idea as well.
> it is still possible to inject area and map tags
This is the critical oversight - what would be the reason to not use a whitelist instead, or even custom tags instead of plain HTML? Most of the existing libraries for sanitizing html work like that.
Curious what the hate for Slack is. I use a 1-person Slack workspace for personal note-taking and memory extension, and I find it is also a super useful tool to manage ideas, photos, shared files in romantic relationships.
For either use case the ability to write bots for it, and the fact that it syncs across devices with multiple simultaneous logins is awesome.
Their desktop client is an abomination. Worst even among electron app. IIRC once it was spanning a process per identity. Because some manager decided to hire bootcamp webshits. It is possible to do much more decent apps with even electron.
And when an article about electron was posted, a person from Slack, 'javascript hacker at slack' in his bio, jumped to defend it without even putting a disclaimer.
Now they are treating a security researcher badly with this low bounties. This guy has good intentions and didn't want to sell it. But even if 10% of people sell it or use on behalf of nation state actors, imagine the dammage.
Pretty sure it is some shitty MBAs who don't even know about technology being there.
It is not welcome to be undeplomatic on HN, I know. But let me say this out. Fucking non technical people should not be allowed to decide on technical matters. But those shitheads generally have political abilities. That's what happened when Larry Page tried to oust those suits out of Google engineering divisions.
oskarsv|5 years ago
Sure the bounty is low, but ultimately it's their money and their decision. They will deal with the 'consequences' of others skipping their program and some public shaming.
I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces? Jesus, not everything is about money - it was a fun challenge to chain it all together and I learned a lot from it.
The most outrageous part for me was the blog post I discovered by accident - it included no references or mentions (check archive.org). Both of the code snippets there are from my RCE reports. At the same time they were denying my requests for disclosure.
Of course, I understand that coordination mistakes like this happen, so I accept their apology and move on!
Evidence - original RCE video with huge CSS injection overlay: https://www.dropbox.com/s/11pv2ghdkw5g84b/css-rce-overlay.mo...
krageon|5 years ago
If you haven't had food for a few days everything is indeed about money. Either you reward someone properly for the work that they can do or they'll find someone else who does. I doubt most people get fuzzy warm feelings helping a big US corporation that's too greedy to actually pay independent researchers properly.
Edit: That's not to say your work wasn't cool btw. It's very admirable for you to view it the way you do.
securitron|5 years ago
I work with some security engineers who in previous jobs used to write exploits for the highest bidder. Their stuff ended up being used for exactly this. One of them even told me quite proudly, you know that exploit that was in the news, that was mine.
The lack of any ethical framework other than "I want to make as much money as possible" viscerally disgusts me. And there is far too much of this in our industry, it's rife with this sort of ingrained dollar-chasing selfishness with not a care of the consequences.
Good on you for taking a positive ethical stand against this. It's very refreshing to hear.
kamyarg|5 years ago
As a slack user, seeing them pay < $2K for RCE report does not make me feel safe. Next person finding something similar might be looking into this and saying "$3K? no thank you, I take the risk of getting caught but being paid fairly."
To be clear I am not advocating for this, but it makes me concerned as a user "some people" will be more likely to do it.
outime|5 years ago
>You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces? Jesus, not everything is about money
Not me, not you, but many people make it all about money. I don't think it's ridiculous to think that people can have absolutely zero ethics.
hartator|5 years ago
fouc|5 years ago
It would be interesting if security reporters had a habit of ending their reports with what they feel is the fair market rate.
Mandatum|5 years ago
Just sucks - marketing, legal, the engineer and peers who reviewed it, security..
vmception|5 years ago
Uh lol.
Bug bounties gravitate to their market value by showing companies how valuable they actually are and forcing them to learn.
ActorNightly|5 years ago
make3|5 years ago
Voliokis|5 years ago
And frankly, we shouldn't be giving companies a pass for being cheap because "reporting it responsibly" is the right thing to do. These companies are benefiting to a great degree by offloading vital security research onto unaffiliated and unknown third-parties. Your time, as well as the time of any other hacker or researcher, is valuable and needs to be compensated. I don't see why it's fair to any of us that we should have to work for free or for low pay-outs just because we might be doing the right thing. Same goes for any other career that is badly paid just because "they're helping people".
Yajirobe|5 years ago
[deleted]
albntomat0|5 years ago
Slack is directly taking advantage of that being the only alternative. You can do whatever you want with the money. However, having a robust bug bounty program ensures a wide range of people are both willing and able to look for and report vulnerabilities. This needs to be a requirement for any large successful company handling a large amount of user data. Slack can definitely afford it, and this can be used against them the next time they report a breach.
sjy|5 years ago
bawolff|5 years ago
algesten|5 years ago
Stuff like that happen. We should only judge them if they screw up like that again.
rvz|5 years ago
$1,750 for a detailed report on a critical RCE is like rewarding sniffer-dogs with breadcrumbs. One could sell this exploit at least for 5 figures on the black market.
In all cases, since Electron brings XSS to the desktop, it is a hackers paradise.
justsomeuser|5 years ago
I reported it on HackerOne, it was only after I refused to post it on their free program that they added me to their paid private one.
It was marked as "medium", I got $250 for it.
jansommer|5 years ago
pansa2|5 years ago
Just curious - what makes XSS on the desktop different from other kinds of RCE vulnerability?
laurent92|5 years ago
By the way, the security bounty should be mandatory to display to customers. It’s like saying “We don’t value the sum of all your data of all customers to more than $1750”.
tptacek|5 years ago
gorgoiler|5 years ago
I have no idea what I’m talking about but my guess would be that the security economics of finding an RCE make it very valuable. The disclosure would be worth considerably more to Slack than this bounty. Something in the order of months’ worth of skilled labour, not hours.
I suppose the economics also mean Slack only have to outpay the bad guys, so this is really showing us poorly compensated black hat labor is?
user5994461|5 years ago
The vulnerability could do great to pown a company as long as you already have a compromised user account in the company. That's not a wormable RCE, that's not zero click (I'm not saying it's not bad).
Is there a market for high touch highly targeted attacks, maybe, if you can enter in business with the NSA or a ransomware group, those few who can monetize this sort of things. Good luck.
sneak|5 years ago
jcims|5 years ago
https://hackerone.com/slack?type=team
It says right on the tin what the payout is going to be. If you don't like the terms of the program, don't participate. It's not really that difficult a concept.
EE84M3i|5 years ago
Cool to see how they used the html injection gadget.
Seems like slack messed up with the blog post but made a sincere attempt to make amends.
I've noticed slack is pretty good about allowing disclosure of H1 bugs. It's a really hard sell in a lot of companies, so I think they should be applauded for that.
kevsim|5 years ago
I guess the moral of the story is try to not having place where arbitrary HTML is injected?
missblit|5 years ago
The other moral of the story is you need to be extra careful to write a secure Electron program, since XSS is a bigger problem than it would be in a desktop browser. Step 3 shows that the RCE could execute programs outside of the JS environment.
bawolff|5 years ago
Additionally, csp/iframe have a sandbox flag that can prevent navigating the _top target, which may have prevented this exploit assuming it could have been used (dont know what the slack code looks like, maybe there was some reason it wasn't applicable)
nahbulursun|5 years ago
0xy|5 years ago
This kind of response to security researchers just invites the next researcher to sell the exploit instead, or to actively exploit it.
Why does Slack seem like a company that is floundering? It took them over two years to release a simple feature like shared channels. It seems like the app is frozen in time and the company is doing nothing except keeping the lights on and waiting for Teams to obliterate them.
Slack turned from a hungry tiger startup into an exhausted lumbering enterprise giant whose primary weapon is litigation and mudslinging (Slack initially encouraged the Teams competition, then filed suit against Microsoft in perhaps the biggest case of corporate sour grapes in some time).
Pay your security researchers properly, Slack.
thefreeman|5 years ago
You think merging two or more organizations workspaces in a sane and secure manner after likely basing the entire app infrastructure around the idea of a single workspace is a "simple feature"? This is a textbook example of the classic HN comment "Why does this this company need X engineers to create Y product. I could do it in a weekend."
shermanmccoy|5 years ago
violetgarden|5 years ago
I don’t know where I’m going with this, but the correspondence with Slack just felt off to me. I was also disappointed that we were shouting from the rooftops a serious vulnerability, and we kept getting responses like “clear cache, try reinstalling the app.”
dowakin|5 years ago
lordnacho|5 years ago
Perhaps the model should be an immediate price like the one that was offered, but also the ability to ask for more, confidentially. For instance you might feel this thing is worth more like $10k, and you could show the screengrab. Then the firm can decide whether to just pay up or haggle. And of course you still have Hacker One to arbitrate that the vuln is actually what was touted.
Nothing's perfect, of course there are holes in this idea as well.
keymone|5 years ago
kamyarg|5 years ago
ricardobeat|5 years ago
This is the critical oversight - what would be the reason to not use a whitelist instead, or even custom tags instead of plain HTML? Most of the existing libraries for sanitizing html work like that.
29athrowaway|5 years ago
https://hackerone.com/slack
touchpadder|5 years ago
SXX|5 years ago
Angeo34|5 years ago
GEBBL|5 years ago
I hope Slack review the payment and give you a bit more.
TheUndead96|5 years ago
dheera|5 years ago
For either use case the ability to write bots for it, and the fact that it syncs across devices with multiple simultaneous logins is awesome.
jogundas|5 years ago
er0k|5 years ago
higerordermap|5 years ago
Their desktop client is an abomination. Worst even among electron app. IIRC once it was spanning a process per identity. Because some manager decided to hire bootcamp webshits. It is possible to do much more decent apps with even electron.
And when an article about electron was posted, a person from Slack, 'javascript hacker at slack' in his bio, jumped to defend it without even putting a disclaimer.
Now they are treating a security researcher badly with this low bounties. This guy has good intentions and didn't want to sell it. But even if 10% of people sell it or use on behalf of nation state actors, imagine the dammage.
Pretty sure it is some shitty MBAs who don't even know about technology being there.
It is not welcome to be undeplomatic on HN, I know. But let me say this out. Fucking non technical people should not be allowed to decide on technical matters. But those shitheads generally have political abilities. That's what happened when Larry Page tried to oust those suits out of Google engineering divisions.